MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Spambot.Kelihos


Vendor detections: 19


Intelligence 19 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA3-384 hash: 4ab2f05bdcd4afbb0c2025d19c39267bca418fad9e35a639d16ecd5c3bc4cf6291371e80287e1284ceea7375ac075d87
SHA1 hash: 751b555a8eede96d55395290f60adc43b28ba5e2
MD5 hash: f5d7b79ee6b6da6b50e536030bcc3b59
humanhash: alabama-sweet-tennessee-magazine
File name:file
Download: download sample
Signature Spambot.Kelihos
Create hunting rule
File size:425'984 bytes
First seen:2024-09-13 14:05:21 UTC
Last seen:2024-12-18 10:53:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9c7c36eb46cc991a5074f8a811c4c46c (3 x Amadey, 1 x Spambot.Kelihos)
ssdeep 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
TLSH T195946D207813C032D61192715E68FFF684DDB9259F7109DB77D80F3AAE211E26A35E3A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter jstrosch
Tags:exe Spambot.Kelihos


Avatar
jstrosch
Found at hxxp://185.215.113[.]26/Nework.exe by #subcrawl

Intelligence

File Origin
# of uploads :
4
# of downloads :
360
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
2775dc921ddf7d7c96c7c9d7bbebba32.exe
Verdict:
Malicious activity
Analysis date:
2024-09-06 07:52:50 UTC
Tags:
amadey botnet stealer loader redline metastealer stealc themida cryptbot payload lumma netreactor purehvnc crypto-regex
Link:
https://app.any.run/tasks/6658cfe0-e17c-4054-99c8-9debfe37d3d7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Malware.Generic-10033391-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e446d202c7d3d9942f776d
Tags:
Execution Infostealer Network Stealth Trojan Variant
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Searching for the window
Connection attempt to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
amadey amadey epmicrosoft_visual_cc lolbin microsoft_visual_cc shell32
Link:
https://www.filescan.io/uploads/66e446decadf9d826876281e/reports/488ba543-cc9d-4d07-be87-0f166b9c8248/overview
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b245d03c-3079-47ac-887c-e170f6e0acff
Result
Threat name:
LummaC, Amadey, Clipboard Hijacker, Cryp
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1510863
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Amadeys stealer DLL
Yara detected Clipboard Hijacker
Yara detected Cryptbot
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1510863 Sample: file.exe Startdate: 13/09/2024 Architecture: WINDOWS Score: 100 58 stitchmiscpaew.shop 2->58 60 sevtvd17ht.top 2->60 62 10 other IPs or domains 2->62 78 Suricata IDS alerts for network traffic 2->78 80 Found malware configuration 2->80 82 Antivirus detection for URL or domain 2->82 84 13 other signatures 2->84 10 file.exe 5 2->10         started        14 service123.exe 2->14         started        16 service123.exe 2->16         started        18 7 other processes 2->18 signatures3 process4 file5 50 C:\Users\user\AppData\Local\...\Hkbsse.exe, PE32 10->50 dropped 52 C:\Users\user\...\Hkbsse.exe:Zone.Identifier, ASCII 10->52 dropped 90 Contains functionality to inject code into remote processes 10->90 20 Hkbsse.exe 22 10->20         started        signatures6 process7 dnsIp8 64 185.215.113.26, 49706, 80 WHOLESALECONNECTIONSNL Portugal 20->64 66 iakovosioannidis.com 62.133.62.93 FIRSTDC-ASRU Russian Federation 20->66 42 C:\Users\user\AppData\Local\...\JUmer.exe, PE32 20->42 dropped 44 C:\Users\user\AppData\Local\...\JLumma.exe, PE32 20->44 dropped 46 C:\Users\user\AppData\Local\...\JLumma[1].exe, PE32 20->46 dropped 48 C:\Users\user\AppData\Local\...\JUmer[1].exe, PE32 20->48 dropped 86 Multi AV Scanner detection for dropped file 20->86 88 Machine Learning detection for dropped file 20->88 25 JUmer.exe 4 20->25         started        30 JLumma.exe 20->30         started        file9 signatures10 process11 dnsIp12 74 sevtvd17ht.top 195.133.13.230 AS-REGRU Russian Federation 25->74 54 C:\Users\user\AppData\...\service123.exe, PE32 25->54 dropped 56 C:\Users\user\...\dsaecUhmhBmCqJSkvyEn.dll, PE32 25->56 dropped 92 Multi AV Scanner detection for dropped file 25->92 94 Found many strings related to Crypto-Wallets (likely being stolen) 25->94 96 Uses schtasks.exe or at.exe to add and modify task schedules 25->96 104 2 other signatures 25->104 32 service123.exe 25->32         started        35 schtasks.exe 1 25->35         started        98 Antivirus detection for dropped file 30->98 100 Writes to foreign memory regions 30->100 102 Allocates memory in foreign processes 30->102 106 2 other signatures 30->106 37 BitLockerToGo.exe 30->37         started        file13 signatures14 process15 dnsIp16 76 Found evasive API chain (may stop execution after checking mutex) 32->76 40 conhost.exe 35->40         started        68 basedsymsotp.shop 104.21.78.130 CLOUDFLARENETUS United States 37->68 70 stitchmiscpaew.shop 172.67.136.135 CLOUDFLARENETUS United States 37->70 72 3 other IPs or domains 37->72 signatures17 process18
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459/
Threat name:
Win32.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2024-08-25 00:59:49 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4np6kewdoqm5bpkby23re3lyod7qt2ftjfb2y6zmthhty2lqrmq._file
Verdict:
malicious
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:ec08f7 discovery trojan
Link:
https://tria.ge/reports/240913-redxpstepe/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Amadey
Malware Config
C2 Extraction:
http://185.215.113.26
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ccb237f5-1d6b-4736-8231-ea872a7dd532
Unpacked files
SH256 hash:
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 hash:
f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 hash:
751b555a8eede96d55395290f60adc43b28ba5e2
Detections:
Amadey
Create hunting rule
win_amadey_auto
Create hunting rule
win_amadey
Create hunting rule
Link:
https://www.unpac.me/results/aa4e0564-5542-41b5-8980-672199272873/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2f1aff28961b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Generic_Threat_1f2e969c
Create hunting rule
Author:Elastic Security
Rule name:Windows_Generic_Threat_bd24be68
Create hunting rule
Author:Elastic Security
Rule name:win_amadey_a9f4
Create hunting rule
Author:Johannes Bader
Description:matches unpacked Amadey samples
Rule name:win_amadey_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.amadey.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Spambot.Kelihos

Executable exe 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3132242/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::GetSidSubAuthority
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetSidIdentifierAuthority
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
SHELL32.dll::SHFileOperationA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetFileAttributesA
KERNEL32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameA
ADVAPI32.dll::LookupAccountNameA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo

Comments