MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24e77b29265196c00b2ec0f971dd4c94c092344eadfa20f89abe206c9baacf52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24e77b29265196c00b2ec0f971dd4c94c092344eadfa20f89abe206c9baacf52
SHA3-384 hash: caa78b9314a4e40023bbcc4742b2fadb41864d9df051acb4865c2c257b5dbb60fc6441d8154d8256d7da138239877a80
SHA1 hash: 45bf1f5a29bbf98b3834173df83f01b6d2ded9c1
MD5 hash: 047e39feb1733f5801d46447634789f9
humanhash: pizza-item-oregon-shade
File name:047E39FEB1733F5801D46447634789F9.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:3'821'608 bytes
First seen:2021-05-29 12:10:35 UTC
Last seen:2021-05-29 12:47:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'604 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:XsL5uZucSP2MxSJU2hOI8VfVEf+yC4jwa8Gvu8IWsGxWcCUOG+QVDPeKRLmqVp4P:NN
Threatray 27 similar samples on MalwareBazaar
TLSH 4A065434A97364D566B43FE809C07CE8802F286E253CFDC2676AB7DC87636C29911779
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://185.215.113.38/fT5YhO/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.215.113.38/fT5YhO/index.php https://threatfox.abuse.ch/ioc/66775/

Intelligence

File Origin
# of uploads :
2
# of downloads :
449
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
24e77b29265196c00b2ec0f971dd4c94c092344eadfa20f89abe206c9baacf52
Verdict:
Malicious activity
Analysis date:
2021-05-26 12:24:02 UTC
Tags:
trojan amadey opendir loader stealer
Link:
https://app.any.run/tasks/825bbabe-e28b-4c57-9530-ca198c8d5b9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/163168/
Detection(s):
SecuriteInfo.com.Trojan.Siggen13.22803.11913.11672.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a file
Creating a window
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Launching a service
Deleting a recently created file
Running batch commands
Adding an access-denied ACE
Launching the default Windows debugger (dwwin.exe)
Setting a single autorun event
Unauthorized injection to a recently created process
Adding exclusions to Windows Defender
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/794238
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Detected potential unwanted application
Drops PE files with benign system names
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 426634 Sample: dOAim8sFZw.exe Startdate: 29/05/2021 Architecture: WINDOWS Score: 96 56 Multi AV Scanner detection for submitted file 2->56 58 Detected potential unwanted application 2->58 60 Machine Learning detection for sample 2->60 62 2 other signatures 2->62 7 dOAim8sFZw.exe 8 9 2->7         started        11 svchost.exe 2->11         started        13 svchost.exe 2->13         started        15 5 other processes 2->15 process3 file4 48 C:\Users\Public\Documents\...\svchost.exe, PE32 7->48 dropped 50 C:\Users\...\svchost.exe:Zone.Identifier, ASCII 7->50 dropped 52 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 7->52 dropped 64 Adds a directory exclusion to Windows Defender 7->64 66 Tries to delay execution (extensive OutputDebugStringW loop) 7->66 68 Hides threads from debuggers 7->68 74 2 other signatures 7->74 17 dOAim8sFZw.exe 7->17         started        20 AdvancedRun.exe 7->20         started        23 cmd.exe 7->23         started        27 5 other processes 7->27 70 Multi AV Scanner detection for dropped file 11->70 72 Machine Learning detection for dropped file 11->72 25 WerFault.exe 13->25         started        signatures5 process6 dnsIp7 46 C:\Users\user\AppData\Local\...\blfte.exe, PE32 17->46 dropped 29 blfte.exe 17->29         started        54 192.168.2.1 unknown unknown 20->54 32 AdvancedRun.exe 20->32         started        34 conhost.exe 23->34         started        36 timeout.exe 23->36         started        38 conhost.exe 27->38         started        40 conhost.exe 27->40         started        42 conhost.exe 27->42         started        44 conhost.exe 27->44         started        file8 process9 signatures10 76 Multi AV Scanner detection for dropped file 29->76 78 Machine Learning detection for dropped file 29->78
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24e77b29265196c00b2ec0f971dd4c94c092344eadfa20f89abe206c9baacf52/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-26 11:18:12 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ettxwkjgkglmaczoyd4xdxkmstajencovx5cb6e2xyqgzg5kz5ja._file
Verdict:
unknown
Similar samples:
1b8733a553b25ca6338c13d25d938778f515f4c87229f3b632077c450c36ea98
Amadey
3ebf027f17e2ba9e5689a67df4f1375297e9f43d258ac0b781d6fb27305fd452
Amadey
507563bcdeb37a14d6603a445a087dc812d1a4decd926ca990771b8dc4d7e842
Amadey
76fe551abdf8ee9d70991dc8de3a7dab5d1cb5605072f1d54f8b4ae4a6e03100
Amadey
7a11431e141079aabfbc23a56ab312d3094828c2eb0b1033bb17692054f70208
Amadey
a0e9aa9f568659436c4cff3d544a8d4d195ca9a6b30e8a7cdd5aeeeaa8e7d90f
Amadey
b6ba4103948b273cf686f35f58c8af4569c82ffcc9fbe21f30abb700ab692ca3
Amadey
c219ddb9f7bcad27d8db887346a8dcf70c98c08af9107f55bd2dad9499c680ac
Amadey
e472de49ad18d1f76d03a278b13a43b0b8bc2145d9407f120aace6671ff9cd4b
Amadey
ee3775bbabe2fa2c0e514e2e8f35c160af535f3437d73d341f8b6bd7fd32e5e4
Amadey
+ 17 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210529-9yxbjmfb5s/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads local data of messenger clients
Windows security modification
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Nirsoft
Amadey
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
Windows security bypass
Malware Config
C2 Extraction:
185.215.113.38/fT5YhO/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24e77b29265196c00b2ec0f971dd4c94c092344eadfa20f89abe206c9baacf52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163168/

Comments