amadey | 5402ba11383fb9e461f233cffca5911d1320a3dac3b7aef2fb2b7bc7314ebaee | Triage

Sharing

General

Target

4572-3-0x0000000000400000-0x0000000000472000-memory.dmp
Size

456KB
Sample

240618-k4vhes1brr
MD5

5ec5144934abd7c8c1b99d66eafe1fa1
SHA1

72affe9636b9718a10518612b5d92e4e1d527051
SHA256

5402ba11383fb9e461f233cffca5911d1320a3dac3b7aef2fb2b7bc7314ebaee
SHA512

decfc27a7e5e332bc799f4356bc7ca783774dbdb9672d3a01bffe7287af8d3a61e5a8b0049147a5d442c919f7c9f74880e399e36b89028c561e06f4092d13241
SSDEEP

12288:58m7eJ8uBNne5pAeNaeLSPBWKuJ+Q8NxjvRO7:5u8uBNnopx5Sg8zRO7

Score

10^/10

amadey 8fc809

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

C2

http://nudump.com

http://otyt.ru

http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Targets

- Target
  
  4572-3-0x0000000000400000-0x0000000000472000-memory.dmp
- Size
  
  456KB
- MD5
  
  5ec5144934abd7c8c1b99d66eafe1fa1
- SHA1
  
  72affe9636b9718a10518612b5d92e4e1d527051
- SHA256
  
  5402ba11383fb9e461f233cffca5911d1320a3dac3b7aef2fb2b7bc7314ebaee
- SHA512
  
  decfc27a7e5e332bc799f4356bc7ca783774dbdb9672d3a01bffe7287af8d3a61e5a8b0049147a5d442c919f7c9f74880e399e36b89028c561e06f4092d13241
- SSDEEP
  
  12288:58m7eJ8uBNne5pAeNaeLSPBWKuJ+Q8NxjvRO7:5u8uBNnopx5Sg8zRO7
Score

1^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2