MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 347e02a09cbfbc55944722bacf6e5dc2d7bb8f58c0e0da98f8880e7ce242bc62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 6

Intelligence 6 IOCs YARA 40 File information Comments

SHA256 hash:	347e02a09cbfbc55944722bacf6e5dc2d7bb8f58c0e0da98f8880e7ce242bc62
SHA3-384 hash:	219b5980019ebec76eecd3bdd8b045153f817116a29bfd894d82ce02f2820306b6b24d2e880a4101fa63e6e1a4ab8c96
SHA1 hash:	9c5d2bb81ff5d6773061789915597aa10e91323d
MD5 hash:	7e235cf3aa1adc40014c37ee5ee8ff16
humanhash:	carpet-lake-tango-london
File name:	trx39.zip
Download:	download sample
Signature	Amadey Create hunting rule
File size:	25'431'387 bytes
First seen:	2025-02-24 09:08:06 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:ykc1jLu6uvNiX8glOR+fytVrrEaur+c76usvKg:yVR/uvN/gcBVrhjZ
TLSH	T1944733BA89B73D9B4171AF2825A468DA3A7F40C1F7C7E819DDCA14709DF92016F2F015
Magika	zip
Reporter	skocherhan
Tags:	Amadey zip

skocherhan

http://xingpai.weilay.com.cn/trx39.zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 8 file(s), sorted by their relevance:

File name:	png.1413131
File size:	0 bytes
SHA256 hash:	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash:	d41d8cd98f00b204e9800998ecf8427e
MIME type:	inode/x-empty
Signature	Amadey

File name:	Sunny.dll
File size:	12'908'544 bytes
SHA256 hash:	caa264903df557539daa73dac4dd634a9b88d5f34e55e0abac0296061936062c
MD5 hash:	4cc60b87a27a79a5bbbd34ee91e64e37
MIME type:	application/x-dosexec
Signature	Amadey

File name:	ip.txt
File size:	13 bytes
SHA256 hash:	78c3d80d3913da0dba5bd965f2723c872912788c5decd8b6556b6f3a9eb2fa09
MD5 hash:	9610648595ba0a38bbdfdb7f4601b163
MIME type:	text/plain
Signature	Amadey

File name:	node.dll
File size:	34'361'280 bytes
SHA256 hash:	1b3ba529441555e51666edae574f0adab7da47c622069fe0557db2816d87c229
MD5 hash:	deca77b2d3a5513a69f6d47fe1d19e78
MIME type:	application/x-dosexec
Signature	Amadey

File name:	aqfvad.fdafad
File size:	581'584 bytes
SHA256 hash:	ca1f26619b4483f4bda6b4d352b58a9c4f30c2e985e62e761b7d6f3440922264
MD5 hash:	e6a3caccbd9ca82f38a14bd0d4428240
MIME type:	application/x-dosexec
Signature	Amadey

File name:	gii.txt
File size:	5'009'920 bytes
SHA256 hash:	313d7b7077a806ccc280a7a533b71783d900e7a228c2f60da2d93ced98100f40
MD5 hash:	315d70d415a5e197d7e45429b625eec5
MIME type:	application/octet-stream
Signature	Amadey

File name:	lg.dll
File size:	349'184 bytes
SHA256 hash:	6a2e507143899e23945663cacc0c30c9f2675242372e3247f2a46f236f9dc2a5
MD5 hash:	216c16cdc10e842dfc2a9d22cd1f2874
MIME type:	application/x-dosexec
Signature	Amadey

File name:	TASLoginBase.dll
File size:	2'044'928 bytes
SHA256 hash:	11bae3bf75e46fc18cd697e7db3d63079aeddc5f738507a657e37f1e224017af
MD5 hash:	8f39e12ac8b5e34953b8be4a3f49ab45
MIME type:	application/x-dosexec
Signature	Amadey

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bc370b28ab76d43a5cd375

Tags:

malware

Verdict:

Suspicious

Labled as:

Trojan.Generic.bot

Link:

https://www.hybrid-analysis.com/sample/347e02a09cbfbc55944722bacf6e5dc2d7bb8f58c0e0da98f8880e7ce242bc62

Gathering data

Threat name:

Win32.Infostealer.Babar

Status:

Malicious

First seen:

2025-02-24 09:08:22 UTC

File Type:

Binary (Archive)

Extracted files:

183

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gr7afie4x66flfchek5m63s5yll3xd2yydqnvghyrahhzyscxrra._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250224-l48kqawmx2/

Behaviour

Suspicious use of WriteProcessMemory

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/347e02a09cbfbc55944722bacf6e5dc2d7bb8f58c0e0da98f8880e7ce242bc62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Bitter_ZxxZ_Downloader Create hunting rule
Author:	SECUINFRA Falcon Team (@SI_FalconTeam)
Description:	Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:	https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	cybercrime_swisscom_html Create hunting rule
Author:	Marc
Description:	HTML with swisscom

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Mimikatz_Generic Create hunting rule
Author:	Still
Description:	attempts to match all variants of Mimikatz

Rule name:	pecompact2 Create hunting rule
Author:	Kevin Falcoz
Description:	PECompact

Rule name:	PECompact2xxBitSumTechnologies Create hunting rule
Author:	malware-lu

Rule name:	PECompactV2XBitsumTechnologies Create hunting rule
Author:	malware-lu

Rule name:	PECompactv2xx Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_packer_pecompact2 Create hunting rule
Author:	@jstrosch

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	reverse_http Create hunting rule
Author:	CD_R0M_
Description:	Identify strings with http reversed (ptth)

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	SuspiciousDll Create hunting rule
Author:	martclau
Description:	Detects SolarWinds Orion backdoor

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	win_amadey_bytecodes_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

zip 347e02a09cbfbc55944722bacf6e5dc2d7bb8f58c0e0da98f8880e7ce242bc62

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3450681/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample