MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA3-384 hash: 369cb9db9795f9e78a62c859e3fbe56ae9c183102f43bfaf70e630065d4bc9dd14b47dd7dc93e6e81885a9ad89f95906
SHA1 hash: e487edceeef3a41e2a8eea1e684bcbc3b39adb97
MD5 hash: 522adad0782501491314a78c7f32006b
humanhash: pasta-delaware-pennsylvania-single
File name:522adad0782501491314a78c7f32006b
Download: download sample
Signature Amadey
Create hunting rule
File size:129'024 bytes
First seen:2022-10-31 18:07:07 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a02ab1a937fc1433a9abad7bc2badee6 (47 x Amadey)
ssdeep 3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
Threatray 531 similar samples on MalwareBazaar
TLSH T1C2C36D73F1D08872D0B10E7CED5AE698663EFE202C351657B6E94E4C693B2C1296C2C7
TrID 38.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
18.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
12.3% (.EXE) Win32 Executable (generic) (4505/5/1)
8.2% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter zbetcheckin
Tags:32 Amadey dll exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/326533/
Detection(s):
Win.Malware.Zusy-9753108-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
amadey greyware spybot stealer zusy
Link:
https://www.filescan.io/uploads/63600f0358409ff7bc0c64b3/reports/abba36b4-8961-4835-8638-aa059406c38c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b3ae70f-e6f2-4770-bbe8-4810f867e894
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
phis.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1101946
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected Amadeys stealer DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 734608 Sample: 7ZSVh1b31u.dll Startdate: 31/10/2022 Architecture: WINDOWS Score: 96 35 Malicious sample detected (through community Yara rule) 2->35 37 Antivirus / Scanner detection for submitted sample 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Amadeys stealer DLL 2->41 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        14 rundll32.exe 8->14         started        16 rundll32.exe 8->16         started        18 3 other processes 8->18 dnsIp5 29 192.168.2.1 unknown unknown 10->29 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->49 51 Tries to steal Instant Messenger accounts or passwords 10->51 53 Tries to steal Mail credentials (via file / registry access) 10->53 55 Tries to harvest and steal ftp login credentials 10->55 20 WerFault.exe 9 10->20         started        57 System process connects to network (likely due to code injection or exploit) 14->57 31 31.41.244.15, 49697, 49704, 80 AEROEXPRESS-ASRU Russian Federation 16->31 33 192.168.2.7, 443, 49692, 49694 unknown unknown 16->33 22 rundll32.exe 18->22         started        25 WerFault.exe 2 9 18->25         started        signatures6 process7 signatures8 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->43 45 Tries to steal Instant Messenger accounts or passwords 22->45 47 Tries to steal Mail credentials (via file / registry access) 22->47 27 WerFault.exe 23 9 22->27         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba/
Threat name:
Win32.Infostealer.Decred
Create hunting rule
Status:
Malicious
First seen:
2022-10-31 16:55:50 UTC
File Type:
PE (Dll)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gup5tnz7udf3366oa6j4uqkuj5izczinpeyxunacj46at5z2zg5a._file
Verdict:
malicious
Similar samples:
0321da385d5c03cea287316cabb9190060cdb444a9816121ede86ec31bcbfdc7
Amadey
12a71166aa4d5fb6054d6e24c777e1b3ab9d10f340967a62d7f141dd79370450
Amadey
1b0135eb9457bbc1cd92e1acfecb9b3cf2c5c7e2ae9ecb97b373790ca795f1c3
Amadey
359d2b9d40da074f01d32c539eb8af8e131b69aef8bead7ffe534e6b28958f09
Amadey
81c87568f2f8b69e7ecda26fa638987c1fbf2cd32011ff615e3512c1466b5db7
Amadey
a7d04fb1606e8cfdaaa9a98742e49f80fc9c650affdac46ac34539de96c3567b
Amadey
ba7b56f37e69ae5e447017ab1d025246ee09dfad3c57d97f67b8b818d1192017
Amadey
f6669b53bb3d32d45755dc5407e50c8ebd2ec82d98ce37136c495dfac3a403d6
Amadey
+ 521 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey collection spyware stealer trojan
Link:
https://tria.ge/reports/221031-wqwn4scecp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_win_path
Program crash
Accesses Microsoft Outlook profiles
Reads local data of messenger clients
Amadey
Detect Amadey credential stealer module
Unpacked files
SH256 hash:
351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
MD5 hash:
522adad0782501491314a78c7f32006b
SHA1 hash:
e487edceeef3a41e2a8eea1e684bcbc3b39adb97
Link:
https://www.unpac.me/results/80dacf79-f8ed-49c7-a7d6-721c42f71224/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_TOOL_PWS_Amady
Create hunting rule
Author:ditekSHen
Description:Detects password stealer DLL. Dropped by Amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

DLL dll 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2392577/
Cape
Cape
https://www.capesandbox.com/analysis/326533/

Comments


Avatar
zbet commented on 2022-10-31 18:07:14 UTC

url : hxxp://31.41.244.15/Mb1sDv3/Plugins/cred64.dll