File name:

skotes.exe

Full analysis: https://app.any.run/tasks/200027ce-fb64-4db1-b6f4-15799c21c108
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: September 28, 2024, 23:02:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
themida
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6C4B5FA44D73D27368A762B5581BCAAE

SHA1:

C31D79C81E6617D85DB268AB62E56AB828E1A2DC

SHA256:

A8E738EB5FE6BAAFC04C22DC1B21E84CE3B9FC12D1C651CCA717ECC2A4F03428

SSDEEP:

98304:FL16Aq9gWKLoZ5/NS5IavwuSHgScvulLlZoDkkwcMu7BaIs589tv4SLynLvuind1:By

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • skotes.exe (PID: 5072)

    • Connects to the CnC server

      • skotes.exe (PID: 5072)

    • AMADEY has been detected (YARA)

      • skotes.exe (PID: 5072)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • skotes.exe (PID: 5072)

    • Starts itself from another location

      • skotes.exe (PID: 6436)

    • Executable content was dropped or overwritten

      • skotes.exe (PID: 6436)

    • The process executes via Task Scheduler

      • skotes.exe (PID: 4732)

  • INFO

    • Create files in a temporary directory

      • skotes.exe (PID: 6436)

    • The process uses the downloaded file

      • skotes.exe (PID: 6436)

    • Themida protector has been detected

      • skotes.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(5072) skotes.exe
C2185.215.113.43
URLhttp://185.215.113.43/Zu7JuNko/index.php
Version4.42
Options
Drop directoryabc3bc1985
Drop nameskotes.exe
Strings (120)rundll32
exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
DefaultSettings.XResolution
ar:
abcdefghijklmnopqrstuvwxyz0123456789-_
Sophos
\
/k
"taskkill /f /im "
&& Exit"
Content-Type: multipart/form-data; boundary=----
\App
VideoID
Main
Avira
ESET
Doctor Web
-executionpolicy remotesigned -File "
abc3bc1985
sd:
--
GET
pc:
"
og:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
AVG
WinDefender
Norton
S-%lu-
SOFTWARE\Microsoft\Windows NT\CurrentVersion
0123456789
kernel32.dll
CurrentBuild
/quiet
st=s
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
\0000
os:
rb
DefaultSettings.YResolution
" && ren
zip
=
vs:
/Zu7JuNko/index.php
Bitdefender
4.42
2019
e2
185.215.113.43
+++
dm:
Powershell.exe
bi:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
cmd
2016
<d>
shell32.dll
-%lu
/Plugins/
ProgramData\
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
&&
Content-Type: application/x-www-form-urlencoded
dll
msi
Content-Disposition: form-data; name="data"; filename="
------
random
ProductName
" Content-Type: application/octet-stream
wb
.jpg
<c>
ComputerName
" && timeout 1 && del
-unicode-
http://
e1
Kaspersky Lab
360TotalSecurity
ps1
cmd /C RMDIR /s/q
d1
un:
cred.dll
&unit=
GetNativeSystemInfo
rundll32.exe
%USERPROFILE%
shutdown -s -t 0
2022
?scr=1
Startup
POST
lv:
Programs
Panda Security
e0
2025
------
cred.dll|clip.dll|
r=
Comodo
AVAST Software
SYSTEM\ControlSet001\Services\BasicDisplay\Video
av:
|
skotes.exe
:::
#
clip.dll
id:
%-lu
https://
Rem
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:22 17:40:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 322048
InitializedDataSize: 117248
UninitializedDataSize: -
EntryPoint: 0x4c4000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start skotes.exe #AMADEY skotes.exe skotes.exe

Process information

PID
CMD
Path
Indicators
Parent process
4732"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\abc3bc1985\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5072"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe" C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\abc3bc1985\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(5072) skotes.exe
C2185.215.113.43
URLhttp://185.215.113.43/Zu7JuNko/index.php
Version4.42
Options
Drop directoryabc3bc1985
Drop nameskotes.exe
Strings (120)rundll32
exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
DefaultSettings.XResolution
ar:
abcdefghijklmnopqrstuvwxyz0123456789-_
Sophos
\
/k
"taskkill /f /im "
&& Exit"
Content-Type: multipart/form-data; boundary=----
\App
VideoID
Main
Avira
ESET
Doctor Web
-executionpolicy remotesigned -File "
abc3bc1985
sd:
--
GET
pc:
"
og:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
AVG
WinDefender
Norton
S-%lu-
SOFTWARE\Microsoft\Windows NT\CurrentVersion
0123456789
kernel32.dll
CurrentBuild
/quiet
st=s
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
\0000
os:
rb
DefaultSettings.YResolution
" && ren
zip
=
vs:
/Zu7JuNko/index.php
Bitdefender
4.42
2019
e2
185.215.113.43
+++
dm:
Powershell.exe
bi:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
cmd
2016
<d>
shell32.dll
-%lu
/Plugins/
ProgramData\
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
&&
Content-Type: application/x-www-form-urlencoded
dll
msi
Content-Disposition: form-data; name="data"; filename="
------
random
ProductName
" Content-Type: application/octet-stream
wb
.jpg
<c>
ComputerName
" && timeout 1 && del
-unicode-
http://
e1
Kaspersky Lab
360TotalSecurity
ps1
cmd /C RMDIR /s/q
d1
un:
cred.dll
&unit=
GetNativeSystemInfo
rundll32.exe
%USERPROFILE%
shutdown -s -t 0
2022
?scr=1
Startup
POST
lv:
Programs
Panda Security
e0
2025
------
cred.dll|clip.dll|
r=
Comodo
AVAST Software
SYSTEM\ControlSet001\Services\BasicDisplay\Video
av:
|
skotes.exe
:::
#
clip.dll
id:
%-lu
https://
Rem
6436"C:\Users\admin\Desktop\skotes.exe" C:\Users\admin\Desktop\skotes.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
733
Read events
730
Write events
3
Delete events
0

Modification events

(PID) Process:(5072) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5072) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5072) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6436skotes.exeC:\Windows\Tasks\skotes.jobbinary
MD5:E8643ACAAEDD3DD45E02CA147C604A91
SHA256:C30FA82ADB3E0DE8EE26A6F55F47FFF6CE4696531E55D64D4E022207079F64CA
6436skotes.exeC:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exeexecutable
MD5:6C4B5FA44D73D27368A762B5581BCAAE
SHA256:A8E738EB5FE6BAAFC04C22DC1B21E84CE3B9FC12D1C651CCA717ECC2A4F03428
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1972
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5072
skotes.exe
POST
200
185.215.113.43:80
http://185.215.113.43/Zu7JuNko/index.php
unknown
—
—
malicious
5072
skotes.exe
POST
200
185.215.113.43:80
http://185.215.113.43/Zu7JuNko/index.php
unknown
—
—
malicious
2580
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3712
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3712
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4324
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1972
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5072
skotes.exe
185.215.113.43:80
—
1337team Limited
SC
malicious
1972
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4344
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.23
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
5072
skotes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5072
skotes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
1 ETPRO signatures available at the full report
Process
Message
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
skotes.exe