Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
27/12/2024, 10:32 UTC
General
-
Target
852-33-0x0000000000260000-0x0000000000587000-memory.exe
-
Size
3.2MB
-
MD5
cc8f2d3b80ee562717b7e9538f192b8f
-
SHA1
3528ee8e8b70b483238ea3298e998eb0e50f964f
-
SHA256
3eb73cc9d209a27a5a0fccc1500f99f3d46e9bdbf81e23a8066c60153ec17b6d
-
SHA512
883b0e5e72573cab3f06390c43b0bf2f8cff3af81c858b426f5b701f2d5c9a01e1d8de40df9a715725d03964eee46ed9e67543643e225a3f77a35c1c248c9e2e
-
SSDEEP
98304:CZy6tRbfgZDbM1GWvEbdeir4cb0Qrz8AmYf:CBvSzzrzxh
Score
10/10
Malware Config
Extracted
Family
amadey
Version
4.42
Botnet
9c9aa5
C2
http://185.215.113.43
Attributes
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
rc4.plain
1
006700e5a2ab05704bbb0c589b88924d
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
Processes
-
C:\Users\Admin\AppData\Local\Temp\852-33-0x0000000000260000-0x0000000000587000-memory.exe"C:\Users\Admin\AppData\Local\Temp\852-33-0x0000000000260000-0x0000000000587000-memory.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB