MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6
SHA3-384 hash: fde641b1ee2d13cfe50bfa50aed487932e31228d75e4fde5e2311000aa156a478a87b362259d35013f019a6a2bedd401
SHA1 hash: 5aadcc89f95baf1452776f3b6a87cd2fbc89bd30
MD5 hash: ed4e77ea9305aeae3b545735358b6d1b
humanhash: pennsylvania-beer-may-london
File name:ed4e77ea9305aeae3b545735358b6d1b.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:353'312 bytes
First seen:2021-04-08 07:48:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e13866414f4ebd95471c7c78ee916de (3 x Amadey, 2 x NetWire)
ssdeep 6144:c+d1099RUF1bK8CprkM82+oIQpje53Z6Ww43n:ld10b6FBKRprrxIQpj0
Threatray 764 similar samples on MalwareBazaar
TLSH 7C74CF1E669470A3D0722F3094A2B7E44378B4649EC765CE9F84663D2DB17C1E8F2EC6
Reporter abuse_ch
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
389
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ed4e77ea9305aeae3b545735358b6d1b.exe
Verdict:
Malicious activity
Analysis date:
2021-04-08 07:59:01 UTC
Tags:
trojan amadey
Link:
https://app.any.run/tasks/82a6ead6-6f30-4021-8f49-de52169e0447

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133082/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/669728
Signature
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadey bot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383811 Sample: C7SRTTLgsn.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 96 34 cdn12-web-security.com 2->34 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected Amadey bot 2->52 11 C7SRTTLgsn.exe 2->11         started        signatures3 process4 signatures5 56 Detected unpacking (changes PE section rights) 11->56 58 Detected unpacking (overwrites its own PE header) 11->58 60 Contains functionality to inject code into remote processes 11->60 62 Maps a DLL or memory area into another process 11->62 14 C7SRTTLgsn.exe 4 11->14         started        process6 file7 32 C:\ProgramData\04bbb7d123\brdm.exe, PE32 14->32 dropped 66 Hides threads from debuggers 14->66 18 brdm.exe 14->18         started        signatures8 process9 signatures10 42 Multi AV Scanner detection for dropped file 18->42 44 Detected unpacking (changes PE section rights) 18->44 46 Detected unpacking (overwrites its own PE header) 18->46 48 Maps a DLL or memory area into another process 18->48 21 brdm.exe 18 18->21         started        process11 dnsIp12 36 cdn12-web-security.com 21->36 38 shegw583reg.hopto.org 54.36.27.31, 80 OVHFR France 21->38 40 192.168.2.1 unknown unknown 21->40 54 Hides threads from debuggers 21->54 25 cmd.exe 1 21->25         started        signatures13 process14 process15 27 reg.exe 1 25->27         started        30 conhost.exe 25->30         started        signatures16 64 Creates an undocumented autostart registry key 27->64
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 22:28:23 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6
Amadey
1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666
Amadey
6cb53f11cd0977599235f756ad6883050db78dab6936da5113729a61cd93036c
Amadey
7499c45e246fe759ff4180bd864252689b1cbadc7825d007c7e25aa39c6a4450
Amadey
8060ecf4c1dc957aefdbfc835361541af83a9e5d6433f5abb073477c59f16e4c
Amadey
8086d2b05316a9b44f55971a6c90da8ecb069d075973654f5f914229dc3070f6
Amadey
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
Amadey
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
Amadey
978d1d6690e83f0508a551f8b469159f3d6ac908e081a33f6c9b632e8ab5e433
Amadey
c366a12ebce6fac89542bd70335a3ad9b0c44692946c6d173234a7840f846812
Amadey
+ 754 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey trojan
Link:
https://tria.ge/reports/210408-e9vtp1qwwe/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Amadey
Malware Config
C2 Extraction:
cdn12-web-security.com/gf4EdsW/index.php
shegw583reg.hopto.org/gf4EdsW/index.php
Unpacked files
SH256 hash:
709f79f3188984078e317e5259d4bf465210352654477e5d45a2f8ac396ed816
MD5 hash:
b81fb43be149ac187ef11aa00827de75
SHA1 hash:
52a06c23b17f2171559fc93a259055d0fdb92a54
Link:
https://www.unpac.me/results/58c9630b-22d1-48cc-97b6-0059e66f01e4/
SH256 hash:
b332fe8a8403d2de30091c59fddc2ec81c05db0e001b150210dd887cef05d644
MD5 hash:
dac441b4d8a7f899b74bfa9710799d82
SHA1 hash:
529e9972018e383d9d025ee768903b59a442fce8
Link:
https://www.unpac.me/results/58c9630b-22d1-48cc-97b6-0059e66f01e4/
SH256 hash:
462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6
MD5 hash:
ed4e77ea9305aeae3b545735358b6d1b
SHA1 hash:
5aadcc89f95baf1452776f3b6a87cd2fbc89bd30
Link:
https://www.unpac.me/results/58c9630b-22d1-48cc-97b6-0059e66f01e4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 462874360a3b4cff7c9fab2448ae25bca022253e71af71b128af502136e8b2e6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1057560/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133082/

Comments