Overview

overview

10

Static

static

10

2656-3-0x0...ry.exe

windows7-x64

1

2656-3-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2656-3-0x0000000000400000-0x0000000000472000-memory.dmp

  • Size

    456KB

  • MD5

    e35f6ace10366e5f4f4651d85393d89b

  • SHA1

    54ebd2d6b7de008ed98f6b3c9677630f901a7a5e

  • SHA256

    42d13f4309ad067716900b99204c72968b653ebaba1b500e2fca2218987fc1a2

  • SHA512

    f177209d42e725825056a91fe819ef2ee06093898702170e4f3355d792e42851b6f53d2b0e96af55471423b12e13b6c4768ecf731b70029705dfe8431968260d

  • SSDEEP

    12288:58m7eJ8uBNne5pAeNaeLSPBWKuJ+Q8NxUvRn7:5u8uBNnopx5Sg8ORn7

Score
10/10
8fc809amadey

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

C2

http://nudump.com

http://otyt.ru

http://selltix.org
Attributes
  • install_dir

    b739b37d80

  • install_file

    Dctooux.exe

  • strings_key

    65bac8d4c26069c29f1fd276f7af33f3

  • url_paths

    /forum/index.php

    /forum2/index.php

    /forum3/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2656-3-0x0000000000400000-0x0000000000472000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections