Analysis
-
max time kernel
95s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 11:28
General
-
Target
2172-3-0x0000000000970000-0x0000000000C8F000-memory.exe
-
Size
3.1MB
-
MD5
e08d69b0cc00cba6a04b1480fab6ac7e
-
SHA1
9c3594b52fcc119dc0105bd3587413410f5a1fb8
-
SHA256
9748b17fad90adfc44df363a7b4e5167bc5ff89d153750d15cddc9d913c4cac6
-
SHA512
512145d6efdf9fd7ad8086370c6a2dfb1c8ba8f95ca77723843a6e0090f925b1b83723af934e688eaf3c3d715fadeed8906a465f010824e07171e3fbed1ef87f
-
SSDEEP
49152:NCLO5MQfGFjxOSXr7z030aVguhr47IupAxJLiSP3ZDj8hL8m:NcO5MQfGFjBfz0EaVgux47bULjDYq
Score
10/10
Malware Config
Extracted
Family
amadey
Version
4.42
Botnet
9c9aa5
C2
http://185.215.113.43
Attributes
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
rc4.plain
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
Processes
-
C:\Users\Admin\AppData\Local\Temp\2172-3-0x0000000000970000-0x0000000000C8F000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2172-3-0x0000000000970000-0x0000000000C8F000-memory.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
-
Filesize
3.1MB