Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2904-3-0x0...ry.exe

windows7-x64

10

2904-3-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2904-3-0x0000000000120000-0x00000000005C5000-memory.dmp

  • Size

    4.6MB

  • MD5

    1e76e4eee7b8fa0edf3729bb15294615

  • SHA1

    33efb8ce5b0fa4280188bcc347d2fbcc38d45029

  • SHA256

    ad93632048047417325ba37513b85320a108a343dc448d4603b45cc4cc14a24f

  • SHA512

    aa10f3869cb6d83f4c0b23f01a86079eeb146cbdfcf4ad342bbbdb1f345f35debe841abea6f5aab1f7abcb71d491bd41e53620e6eac323aec53fc2ee49dd36dc

  • SSDEEP

    98304:zhry7hla2bb+Z23pnmpCxeGaAOpWoc//x1:lsnmpk9aAQWoux1

Score
10/10
fed3aaamadey

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2904-3-0x0000000000120000-0x00000000005C5000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.