MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351
SHA3-384 hash: 15ecf2e85d5850d24db2784502f1b241184ad676d430a30a67ac7b89e9f7dc31ac32441f4b224e7c317da1955a73175f
SHA1 hash: 8386f3af52aa8505d1e668dc7bfecf48c37e8387
MD5 hash: 92ece8f284c4ce928877ec8352206284
humanhash: kentucky-eight-early-montana
File name:92ece8f284c4ce928877ec8352206284.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:271'392 bytes
First seen:2021-04-14 02:05:21 UTC
Last seen:2021-04-14 03:04:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5806337127c1779eba2317d8ff379a05 (1 x Amadey)
ssdeep 3072:9We26CvCXCHpVQH0/5WDD6Z6TEOq5G9/5CZzJaxAjZJssQRFSUR5D5ZrYaE3YXpN:kpVJ5WDD6w3j9ONaxyCuURdnYwg8n
Threatray 863 similar samples on MalwareBazaar
TLSH 0B44E1237BB40C62E62705F10FE1D7751B35FC66C6528E0B2285799D1EB2B82ADD132B
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://cdn12-web-security.com/gf4EdsW/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://cdn12-web-security.com/gf4EdsW/index.php https://threatfox.abuse.ch/ioc/7930/

Intelligence

File Origin
# of uploads :
2
# of downloads :
412
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
92ece8f284c4ce928877ec8352206284.exe
Verdict:
Malicious activity
Analysis date:
2021-04-14 02:23:17 UTC
Tags:
trojan amadey
Link:
https://app.any.run/tasks/3a33ff49-e102-4967-9e17-4852a2f27de0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/134016/
Detection(s):
SecuriteInfo.com.Trojan.QuilClipper.8569.5032.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a process with a hidden window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/674889
Signature
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Potential malicious icon found
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Amadey bot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 386384 Sample: h15v4Z591T.exe Startdate: 14/04/2021 Architecture: WINDOWS Score: 100 34 shegw583reg.hopto.org 2->34 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Multi AV Scanner detection for domain / URL 2->50 52 Potential malicious icon found 2->52 54 Yara detected Amadey bot 2->54 11 h15v4Z591T.exe 2->11         started        signatures3 process4 signatures5 58 Detected unpacking (changes PE section rights) 11->58 60 Detected unpacking (overwrites its own PE header) 11->60 62 Contains functionality to inject code into remote processes 11->62 64 Maps a DLL or memory area into another process 11->64 14 h15v4Z591T.exe 4 11->14         started        process6 file7 32 C:\ProgramData\04bbb7d123\brdm.exe, PE32 14->32 dropped 68 Hides threads from debuggers 14->68 18 brdm.exe 14->18         started        signatures8 process9 signatures10 42 Detected unpacking (changes PE section rights) 18->42 44 Detected unpacking (overwrites its own PE header) 18->44 46 Maps a DLL or memory area into another process 18->46 21 brdm.exe 23 18->21         started        process11 dnsIp12 36 cdn12-web-security.com 212.27.48.10, 443, 49725, 49726 PROXADFR France 21->36 38 shegw583reg.hopto.org 54.36.27.31, 80 OVHFR France 21->38 40 192.168.2.1 unknown unknown 21->40 56 Hides threads from debuggers 21->56 25 cmd.exe 1 21->25         started        signatures13 process14 process15 27 reg.exe 1 25->27         started        30 conhost.exe 25->30         started        signatures16 66 Creates an undocumented autostart registry key 27->66
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-04-14 02:06:06 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6wuohklh2qwis5rcg5m35rqmgescteqb3uiqlb3qxflpvngoniq._file
Verdict:
unknown
Similar samples:
173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6
Amadey
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7
Amadey
3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821
Amadey
462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6
Amadey
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
Amadey
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
Amadey
978d1d6690e83f0508a551f8b469159f3d6ac908e081a33f6c9b632e8ab5e433
Amadey
d1597e584fec8eb356aa5c831045b2ce68531e69fe70436fa3ca0d8dd1d90ca7
Amadey
d9ace2d97010316fdb0f416920232e8d4c59b01614633c4d5def79abb15d0175
Amadey
e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37
Amadey
+ 853 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey trojan
Link:
https://tria.ge/reports/210414-jgq2ck6blx/
Behaviour
Modifies system certificate store
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Amadey
Malware Config
C2 Extraction:
cdn12-web-security.com/gf4EdsW/index.php
shegw583reg.hopto.org/gf4EdsW/index.php
Unpacked files
SH256 hash:
dcb6057d86f148df9503a4ada87a5680d3dea5a328b2d879f124d5903166d99b
MD5 hash:
1a56831091a2a434fc7f050cc5f10395
SHA1 hash:
d63a7974c296e9179e114a6ed5196d905c538b9c
Link:
https://www.unpac.me/results/f99cd5f0-739e-448e-9ae2-7076b8c4beec/
SH256 hash:
37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351
MD5 hash:
92ece8f284c4ce928877ec8352206284
SHA1 hash:
8386f3af52aa8505d1e668dc7bfecf48c37e8387
Link:
https://www.unpac.me/results/f99cd5f0-739e-448e-9ae2-7076b8c4beec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1057560/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/134016/

Comments