Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4800-32-0x...ry.exe

windows7-x64

10

4800-32-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4800-32-0x0000000000D30000-0x000000000104F000-memory.dmp

  • Size

    3.1MB

  • MD5

    be10cfa0078eefcf0d8b61eba43f2bc8

  • SHA1

    c310e1edbdf30038e58a37fbbd1e1167f1602041

  • SHA256

    e293d8cf0db9d24b83216995bdcb4901be64bc186ed2bb8f27dd972b7c09b328

  • SHA512

    acd5e3ca2ffca49ff2d718530a8b0f4f8c0f1b4b7f69707a78ae893d504b9f571f02eb01061342d80cf178ed709f750f21fdd7dede5248cee8c0fd1752a0d538

  • SSDEEP

    24576:zLmrQQR/4aZR0JhaBPzfYmeaCkiA9zlKLzwyiG6grRt6Nep1RNa6008WvMeG30Ny:OQ4/4O0nalfYVvGhBarNvja6r+fqUDM

Score
10/10
9c9aa5amadey

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4800-32-0x0000000000D30000-0x000000000104F000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.