Overview

overview

10

Static

static

10

4108-3-0x0...ry.exe

windows7-x64

1

4108-3-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4108-3-0x0000000000400000-0x0000000000472000-memory.dmp

  • Size

    456KB

  • MD5

    b1967544358bb74af2ff6be3e17e9204

  • SHA1

    6b1a0a8f82537f81abd79d717d1f02b2d1e8a85a

  • SHA256

    474b7b6facd637c49df3e8c82785916f540db41db1dfb9135229a9543ad48cb5

  • SHA512

    1472542b728d204e6380b47a6d0775e794a1b0bd8b44f680e907034dd0f8bb52422769260e837fbf19249839ba1a7d0ac4f466754c015805211c915d05243586

  • SSDEEP

    12288:58m7eJ8uBNne5pAeNaeLSPBWKuJ+Q8NxtvRr7:5u8uBNnopx5Sg89Rr7

Score
10/10
8fc809amadey

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

C2

http://nudump.com

http://otyt.ru

http://selltix.org
Attributes
  • install_dir

    b739b37d80

  • install_file

    Dctooux.exe

  • strings_key

    65bac8d4c26069c29f1fd276f7af33f3

  • url_paths

    /forum/index.php

    /forum2/index.php

    /forum3/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4108-3-0x0000000000400000-0x0000000000472000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections