MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 15


Intelligence 15 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2
SHA3-384 hash: 63ea772d7e18f80da6cfdc8c6632cfc7d665e85a3e4af31f9463711202ba5abf5946042edcdea3c692d7be239991840f
SHA1 hash: 0390e02b35e3988ebf82c43cd22ad77479e6d5f9
MD5 hash: f42d0cefde7434ac7b049de6f980e391
humanhash: winner-four-timing-paris
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:5'802'648 bytes
First seen:2024-01-12 17:51:42 UTC
Last seen:2024-01-13 05:57:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 98304:DbZbBpQtzCYycGg45NfImAUytdiYCWwAj:DbZbBpQtzCYyq45VIptdiTzW
Threatray 73 similar samples on MalwareBazaar
TLSH T184469E02BB95CE11D16D6B37C1E7150453B5E9D36323DA0F36CA33A91A133EE4C8E69A
TrID 43.6% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
34.3% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
6.2% (.EXE) Win64 Executable (generic) (10523/12/4)
3.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon fcccd0dcccdcc4c4 (1 x Amadey)
Reporter jstrosch
Tags:.NET Amadey exe MSIL


Avatar
jstrosch
Found at hxxp://185.172.128[.]121/ama.exe by #subcrawl

Intelligence

File Origin
# of uploads :
3
# of downloads :
355
Origin country :
US US
Vendor Threat Intelligence
Detection:
Amadey
Create hunting rule
Link:
https://www.capesandbox.com/analysis/470580/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.KIT.gen.Eldorado.1006.26932.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a file in the %AppData% subdirectories
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd expand fingerprint hook lolbin overlay packed regsvcs regsvr32
Link:
https://www.filescan.io/uploads/65a17c4cfd5068bbc3d17c06/reports/6faefc1b-37bb-4dd7-be9c-34f812ea8a2b/overview
Verdict:
Malicious
Labled as:
MSIL/Kryptik.AJGW trojan
Link:
https://www.hybrid-analysis.com/sample/4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/539effee-9ba2-473a-8c14-db31b78a354c
Result
Threat name:
Amadey, RevengeRAT, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1373960
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys stealer DLL
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RevengeRAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1373960 Sample: file.exe Startdate: 12/01/2024 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus detection for URL or domain 2->36 38 9 other signatures 2->38 6 file.exe 7 2->6         started        10 Unicode_characters_and_symbols_for_reading.exe 1 2->10         started        process3 file4 26 Unicode_characters...ols_for_reading.exe, PE32 6->26 dropped 28 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 6->28 dropped 40 Writes to foreign memory regions 6->40 42 Allocates memory in foreign processes 6->42 44 Injects a PE file into a foreign processes 6->44 12 RegSvcs.exe 6->12         started        15 RegSvcs.exe 12 6->15         started        18 WerFault.exe 19 16 6->18         started        46 Multi AV Scanner detection for dropped file 10->46 20 RegSvcs.exe 10->20         started        22 RegSvcs.exe 10->22         started        24 RegSvcs.exe 10->24         started        signatures5 process6 dnsIp7 48 Contains functionality to inject code into remote processes 12->48 30 185.172.128.63, 49707, 49708, 49709 NADYMSS-ASRU Russian Federation 15->30 signatures8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=icmhnbis4auqnbwoej5v6yhvs62hiz6mlx7s6btfdvfhycuazkra._file
Verdict:
malicious
Similar samples:
12e5e5bba84f2a618310f72a7fbb40e04bf2f221a13145b3a91bb4707d7130c1
Amadey
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Amadey
4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2
Amadey
43d7e7f51f3ee88c66a2d6062d82d444c04978b3323c5caf5424585be9c0294c
Amadey
5f2bd04f08f1d65836027822cd62d6de03f12be94e89c7cc3c40fbbab44191f2
Amadey
bca1b830105b7ffeae00fea5f3a993586d0b85e9e3ef21db6c71757f2ad32dab
Amadey
fe6064e70c302549004b15d0f89c94776ab0e1ce0c8b6be604e52f4d7beac73d
Amadey
+ 63 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:zgrat rat trojan
Link:
https://tria.ge/reports/240112-wfp4ksdde5/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
.NET Reactor proctector
Drops startup file
Loads dropped DLL
Amadey
Detect ZGRat V1
ZGRat
Malware Config
C2 Extraction:
http://185.172.128.63
Unpacked files
SH256 hash:
9f614eb937f7db8f4ee1b13a5efb9503eec4d63180b5026f7563639c22969e3e
MD5 hash:
9ef573f9fe0ce60e0ad5c3fdedb1f6d0
SHA1 hash:
17dd95e43f5602109ec47192bab57744812f61da
Detections:
win_amadey_auto
Create hunting rule
win_amadey
Create hunting rule
Link:
https://www.unpac.me/results/f2ac8d8a-293e-43e2-aec5-a25533aec2a9/
Parent samples :
4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2
4f7d0800c59a3214c012ff3be7120e1a275ceb70e24530789633eb95a93b54d8
1d0f94b4b4a8810d847191d1673796c647cacc4705174bd4ebd39d77317873e6
SH256 hash:
4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2
MD5 hash:
f42d0cefde7434ac7b049de6f980e391
SHA1 hash:
0390e02b35e3988ebf82c43cd22ad77479e6d5f9
Detections:
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
INDICATOR_KB_CERT_21c9a6daff942f2db6a0614d
Create hunting rule
Link:
https://www.unpac.me/results/f2ac8d8a-293e-43e2-aec5-a25533aec2a9/
Malware family:
RevengeRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4098768512e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:INDICATOR_KB_CERT_21c9a6daff942f2db6a0614d
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:win_amadey_a9f4
Create hunting rule
Author:Johannes Bader
Description:matches unpacked Amadey samples
Rule name:win_amadey_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.amadey.
Rule name:win_amadey_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 4098768512e0290686ce227b5f60f597b47467cc5dff2f06651d4a7c0a80caa2

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2744395/
  
URLhaus
https://urlhaus.abuse.ch/url/2733669/
  
URLhaus
https://urlhaus.abuse.ch/url/2737075/
  
URLhaus
https://urlhaus.abuse.ch/url/2739361/
Cape
Cape
https://www.capesandbox.com/analysis/470580/

Comments