Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2024, 18:56 UTC

General

  • Target

    3800-32-0x0000000000E10000-0x0000000001125000-memory.exe

  • Size

    3.1MB

  • MD5

    a51a27f9916c2cb0f0d445e3df7f4daf

  • SHA1

    5687078806e9c4adabbcaa5af479c85abb957653

  • SHA256

    c34ef22d803ff2ea76253cb0fa1539ea23bae2bf53aa43ea57ded26463664137

  • SHA512

    1636d1282e43f91eeba8a3e991599541a440fbf0ae58266a665eff4fd01b7c204e133e331f8133a443581b17d035939f59763cd8058081f2fca2b49b2f9e2322

  • SSDEEP

    49152:qeKwAmLscCtu3dBRdUMqbmIvgdT7eT+eo2:5KwAmLscCtutB/UMqyI67q+B

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family

Processes

  • C:\Users\Admin\AppData\Local\Temp\3800-32-0x0000000000E10000-0x0000000001125000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\3800-32-0x0000000000E10000-0x0000000001125000-memory.exe"
    1⤵
      PID:1960

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1960-0-0x0000000000E10000-0x0000000001125000-memory.dmp

      Filesize

      3.1MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.