amadey | c04bfb44356ab3371ada950b95cbb6f8cbf7bece49146307dc8b56125eb0917f | Triage

Sharing

General

Target

712-3-0x0000000000400000-0x0000000000472000-memory.dmp
Size

456KB
Sample

240618-w24tvsybkp
MD5

382220ca652fb49e02850331d3f9f135
SHA1

216a169d2fc5d8dea18dd8e0301f8f82a7c37cc7
SHA256

c04bfb44356ab3371ada950b95cbb6f8cbf7bece49146307dc8b56125eb0917f
SHA512

4ea1e195ece316d9e97ee1c4b6e414becccd89cb9998df5aeba803f686985fe4dbc1528b0e77a50c69a55f1b7543b96de548ebf8c732bf678765ed24b88397fc
SSDEEP

12288:58m7eJ8uBNne5pAeNaeLSPBWKuJ+Q8NxAvRM7:5u8uBNnopx5Sg8CRM7

Score

10^/10

amadey 8fc809

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

C2

http://nudump.com

http://otyt.ru

http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Targets

- Target
  
  712-3-0x0000000000400000-0x0000000000472000-memory.dmp
- Size
  
  456KB
- MD5
  
  382220ca652fb49e02850331d3f9f135
- SHA1
  
  216a169d2fc5d8dea18dd8e0301f8f82a7c37cc7
- SHA256
  
  c04bfb44356ab3371ada950b95cbb6f8cbf7bece49146307dc8b56125eb0917f
- SHA512
  
  4ea1e195ece316d9e97ee1c4b6e414becccd89cb9998df5aeba803f686985fe4dbc1528b0e77a50c69a55f1b7543b96de548ebf8c732bf678765ed24b88397fc
- SSDEEP
  
  12288:58m7eJ8uBNne5pAeNaeLSPBWKuJ+Q8NxAvRM7:5u8uBNnopx5Sg8CRM7
Score

1^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2