General

  • Target

    2136-27-0x0000000000D90000-0x000000000162D000-memory.dmp

  • Size

    8.6MB

  • MD5

    8c245bde041ad27bea94dd8802f8ffb3

  • SHA1

    bd32c89e028c9dba8184cc18a482071178f5189f

  • SHA256

    5dd9bc1e91b645a9640db70f9efb7c78633a1a9e278877055b6188c03018f4ce

  • SHA512

    7b7b51e897aef2478c9f7c4a8db65d8fe31cd7930f8397b339bb42e5dd95e02fb52cb97fd71a48fdb28d269d316bb03761bb895c0facbd7d11a20c0a53a46469

  • SSDEEP

    98304:laDOeDk2Daj37160J318LB5YRVsQvS28CZt8FjUF4jhBZtmhjjf8gRP:l8DM1sLjsvvP8pA4dBHmh38

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey family
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2136-27-0x0000000000D90000-0x000000000162D000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections