MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fb3ffc6a0e7738a965020be2f7393b053568fbf7a2b77476c2eda2a54afac67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 13

Intelligence 13 IOCs YARA 33 File information Comments

SHA256 hash:	0fb3ffc6a0e7738a965020be2f7393b053568fbf7a2b77476c2eda2a54afac67
SHA3-384 hash:	9d2f855dd6c130759d6e58e6ab19c56a4cf0b6891aeab987e92e0d23b3bb6bbaa2417809f6fd8d476281ffb2301a4ae8
SHA1 hash:	61f1c4f91fca12cd3d2868eb3079fd4e500ee771
MD5 hash:	2817449fdef8be31b7cd2d2980655063
humanhash:	eight-coffee-glucose-mango
File name:	setup_xrk11.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	54'753'608 bytes
First seen:	2025-08-06 06:23:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5ec789b1a5f77db8015d5c84b86ae08f (1 x Amadey, 1 x ValleyRAT)
ssdeep	786432:C3cTGBYJIrgSgB0w4Da2B8Odtyet2eUBV:Cc6BprPgBP4DFBxdYFe+
Threatray	12 similar samples on MalwareBazaar
TLSH	T1DAC7C0327B80C076E1AF0230997DA76B95B9B9710F3482D7A7E41B2D2F705C26639B53
TrID	85.0% (.AX) DirectShow filter (201555/2/20) 6.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 4.4% (.EXE) Win64 Executable (generic) (10522/11/4) 1.8% (.EXE) Win32 Executable (generic) (4504/4/1) 0.8% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	68e8cc9696c4e860 (1 x Vidar, 1 x Amadey)
Reporter	zhuzhu0009
Tags:	Amadey backdoor exe SilverFox winos

Intelligence

File Origin

# of uploads :

# of downloads :

191

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

setup_xrk11.exe

Verdict:

Suspicious activity

Analysis date:

2025-08-06 06:24:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c3f5f872-639e-4400-955c-25c80275ce4f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6892f52411d7f9b979e5f360

Tags:

dropper emotet virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Running batch commands

Creating a process with a hidden window

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Blocking the User Account Control

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey amadey anti-debug anti-vm anti-vm base64 crypto datper evasive expired-cert expired-cert explorer fingerprint fingerprint invalid-signature keylogger lolbin microsoft_visual_cc oct overlay overlay packed regedit regsvr32 signed threat

Link:

https://www.filescan.io/uploads/6892f5349ef4d2ff7ced6563/reports/f275acb3-c1ce-47cc-948c-41996ed3706b/overview

Verdict:

Suspicious

Labled as:

Malware_49.2

Link:

https://www.hybrid-analysis.com/sample/0fb3ffc6a0e7738a965020be2f7393b053568fbf7a2b77476c2eda2a54afac67

Score:

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/0fb3ffc6a0e7738a965020be2f7393b053568fbf7a2b77476c2eda2a54afac67

Gathering data

Verdict:

Malicious

Threat:

VHO:Exploit.Win64.CVE-2021-21551

Link:

https://tip.neiki.dev/file/0fb3ffc6a0e7738a965020be2f7393b053568fbf7a2b77476c2eda2a54afac67

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b6z77rva45zyvfsqec7c644twbjvnd57pivxor3mf3ncuvfpvrtq._file

Verdict:

malicious

Label(s):

winos

Amadey

2d5d5d3b215efb94e74aa3f719e35f75d41f52b725bc06ea89ee8c5d1910570b

Amadey

315dbb0b234d6a550ac6f314b6accb325f3fe4b35b16f045e131188e03d74e39

Amadey

49ace861126dea98811a915729d0215584cd11bc30d3b8c0353be646f2668285

Amadey

7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4

Amadey

c16e6d3d687b1c83f93cfa8de9c9e191fe957c2262c88534cc6f0b66c4cc516c

Amadey

e104c98fe9b9fc4473018a88b37d9c1029aa444ff74315d5e469aa6db964eb94

Amadey

error

Amadey

f8c117a65e11fd370cb0673d1066af3415dfd9c8fde98225498f6e4ac92c213e

Amadey

+ 2 additional samples on MalwareBazaar

Result

Malware family:

valleyrat_s2

Score:

10/10

Tags:

family:valleyrat_s2 backdoor defense_evasion discovery execution persistence trojan

Link:

https://tria.ge/reports/250806-g6gskasxa1/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UAC bypass

ValleyRat

Valleyrat_s2 family

Malware Config

C2 Extraction:

47.83.171.202:9650
47.83.171.202:9750
47.83.171.202:9850

Verdict:

Malicious

Tags:

ransomware cryptomix Win.Trojan.Ramnit-9872325-0

YARA:

cryptomix_payload

Link:

https://app.threat.zone/submission/3a2576dc-d5b3-46a5-92ff-7ec1077db071

Malware family:

ValleyRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0fb3ffc6a0e7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0fb3ffc6a0e7738a965020be2f7393b053568fbf7a2b77476c2eda2a54afac67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agent_BTZ Create hunting rule

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	ComRAT Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing combination of virtualization drivers

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meduza Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked meduza malware samples.

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RC6_Constants Create hunting rule
Author:	chort (@chort0)
Description:	Look for RC6 magic constants in binary
Reference:	https://twitter.com/mikko/status/417620511397400576

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	skip20_sqllang_hook Create hunting rule
Author:	Mathieu Tartare <mathieu.tartare@eset.com>
Description:	YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:	https://www.welivesecurity.com/

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

Rule name:	win_amadey_bytecodes_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

Rule name:	win_bumblebee Create hunting rule

Rule name:	XData Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_USER_API	Performs GUI Actions	USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample