Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

744-77-0x0...ry.exe

windows7-x64

10

744-77-0x0...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 05:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    744-77-0x0000000000DD0000-0x00000000010DD000-memory.exe

  • Size

    3.1MB

  • MD5

    999c684387b7d0d6d6cbb4ace0905574

  • SHA1

    6b2e6268d3de0d315917b8d8e45b68dea660cb5e

  • SHA256

    84b478db803c2aec97b662d7572cb5e8b0dddd7972014991fb9c1c384b19b2f4

  • SHA512

    41f72d4d28324651ab746abdf0c3d460a6a6427b6ca31a7af0f12d8c6864a8f61ef39d75675e77d5bf0d645802c61abb1d767da4b930202278e113542ae2bc82

  • SSDEEP

    49152:zvvR6vSaBgUmk6SDz5y6RK5wVQGcg2ELuv:DZ6vSaBg7k6SDz5PK52QCLLuv

Score
10/10
amadey9c9aa5trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey

Processes

  • C:\Users\Admin\AppData\Local\Temp\744-77-0x0000000000DD0000-0x00000000010DD000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\744-77-0x0000000000DD0000-0x00000000010DD000-memory.exe"
    1⤵
      PID:3024

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3024-0-0x0000000000DD0000-0x00000000010DD000-memory.dmp

      Filesize

      3.1MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.