MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347
SHA3-384 hash: e4eb2b0e1d0b152e70584f123d7dc560a01e3b140435fd9c4b2ba58b16f9b9a1a79ff62ca7d8234624c4fe5c5ba2d1af
SHA1 hash: 80cffce15379f85641feb73cd2fb07d14ec94e07
MD5 hash: 3a3c8faa0d24925f11db27dfdba9777d
humanhash: neptune-hydrogen-fillet-illinois
File name:2.ps1
Download: download sample
Signature Amadey
Create hunting rule
File size:699'599 bytes
First seen:2025-01-18 08:59:20 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:MLK9F0eB6S02e1BI9iaHHG0MX2VpfWRAwR3SMFH2Rm7NYv:aKNUIt1fpfQ3S5ReNYv
Threatray 49 similar samples on MalwareBazaar
TLSH T182E47C398107BDBE3B2E3E8C94083D851C986EE35718D658FBC8A576B299680DD7C4F4
Magika powershell
Reporter JAMESWT_WT
Tags:92-255-57-155 Amadey booking ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.8074.5107.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678b6ea2aa9c8e7858df79ca
Tags:
virus spawn hype
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
confuserex evasive net obfuscated
Link:
https://www.filescan.io/uploads/678b6da0c8e8c250f1941930/reports/83ed01e9-2501-4113-9c51-f4c23ffb7529/overview
Verdict:
Malicious
Labled as:
MSIL/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347
Result
Verdict:
UNKNOWN
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1594172
Signature
AI detected suspicious sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-01-17 13:04:25 UTC
File Type:
Text
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ascda7ageyiwkhfa3q2fkqkuoqhgaej2ytabshdvjuxrv53mwndq._file
Verdict:
malicious
Label(s):
amadey
Create hunting rule
Similar samples:
0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347
Amadey
3649e0a708a65c8179a1e04cb6d1b176a56fea07e40f1f804023a79f8b3a1743
Amadey
592c6bce92a8a7e8052ef0eb61393e32700330effb1c192b7e9f10318d153cc7
Amadey
94612e0886ff99c116efb730e16034d6f9bc14047699e252304627b264254599
Amadey
b4b819cc534a2e954af69c5ebdf04787656b891c875a526e31bceb1013414e41
Amadey
c847c70bdc3eecede3b89f4d7c88ad538271ea92fcfc3e6bb2ea6e22b83d4d61
Amadey
d991357441b515da8c3719e9d716c55295f4903b47fc4ffe1b59086bf5e69252
Amadey
error
Amadey
+ 39 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:c8dbfa discovery execution trojan
Link:
https://tria.ge/reports/250118-kybhcsymfw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Amadey
Amadey family
Malware Config
C2 Extraction:
http://92.255.57.155
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

PowerShell (PS) ps1 0484307c062611651ca0dc34554154740e60113ac4c0191c754d2f1af76cb347

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3332612/
  
Delivery method
Distributed via web download

Comments