Overview

overview

10

Static

static

10

2520-3-0x0...ry.exe

windows7-x64

10

2520-3-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2520-3-0x0000000000E90000-0x000000000135F000-memory.dmp

  • Size

    4.8MB

  • MD5

    7ec9b30e35dc37a4192ffdc100c7cf26

  • SHA1

    7cfe7c58de88bcdd3a539fcd7c03a69b46514807

  • SHA256

    d1b26d59cf5ac3ec6b12c74adec9c0e3e8b1ba0253d44ce5bf54eb58d465e7be

  • SHA512

    773addea9dea1bce664514cddc2b433c226bdc1173e3459912713df74ab3a6ee986dd0f1d56f82bc4101288f488658cd3bfab5e654c66ba5778ca804050d37af

  • SSDEEP

    98304:ZC8SOh03veK8E/hu9e73lVcOvLCn8FpYln47om0Nvf/m:Zlwr0lnuomq3m

Score
10/10
9c9aa5amadey

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2520-3-0x0000000000E90000-0x000000000135F000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections