🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f
SHA3-384 hash: db28527c6b3db8a8792c05eb5286829084331e3b33efa7f7442140df550daa01e65b7008888d95437f6d8542d548d54e
SHA1 hash: bd8b6b99c5b96f060050b6f44ce52c393679c8b7
MD5 hash: 3524b487c94c169f5075f1b105c57fcf
humanhash: bacon-spaghetti-blossom-nebraska
File name:GeneratedInstaller.ps1
Download: download sample
Signature Amadey
Create hunting rule
File size:10'518'744 bytes
First seen:2025-03-22 22:04:21 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 49152:JYPyt6/IEuTXXQcWvm4H0A6ioeuY2axnUJ3b7nTYaGr7RcWXnFIH+lGkuhMEgXe0:8
TLSH T138B64236CA31BCD8872D360097251C9F21A92557D3F79E28CB161CB63D32B92EF65D88
Magika powershell
Reporter aachum
Tags:Amadey fb3c97 ps1


Avatar
iamaachum
Amadey Botnet: 2329ae
Amadey C2: http://185.196.8.37/Gd85kkjf/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
ES ES
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e193e5acb044ea849e6fe0
Tags:
ransomware virus spawn
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/67df3430a175d31773452582/reports/7f09cbb3-0d6e-4d63-b763-bc96f915ec26/overview
Verdict:
Suspicious
Labled as:
Generik.JAEOEAS trojan
Link:
https://www.hybrid-analysis.com/sample/5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1645908
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Drops PE files with benign system names
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Powershell drops PE file
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: System File Execution Location Anomaly
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1645908 Sample: GeneratedInstaller.ps1 Startdate: 22/03/2025 Architecture: WINDOWS Score: 100 101 Found malware configuration 2->101 103 Malicious sample detected (through community Yara rule) 2->103 105 Antivirus detection for dropped file 2->105 107 15 other signatures 2->107 11 powershell.exe 1 50 2->11         started        15 CiscoCollabHost.exe 1 2->15         started        17 CiscoCollabHost.exe 2->17         started        19 12 other processes 2->19 process3 dnsIp4 91 C:\Users\user\AppData\Local\...\VERSION.dll, PE32+ 11->91 dropped 93 C:\Users\user\...\CiscoSparkLauncher.dll, PE32+ 11->93 dropped 95 C:\Users\user\AppData\...\CiscoCollabHost.exe, PE32+ 11->95 dropped 131 Found suspicious powershell code related to unpacking or dynamic code loading 11->131 133 Loading BitLocker PowerShell Module 11->133 135 Powershell drops PE file 11->135 22 CiscoCollabHost.exe 6 11->22         started        26 conhost.exe 11->26         started        137 Contains functionality to bypass UAC (CMSTPLUA) 15->137 139 Contains functionality to start a terminal service 15->139 141 Sample is not signed and drops a device driver 15->141 143 Potentially malicious time measurement code found 15->143 28 svchost.exe 15->28         started        30 cmd.exe 15->30         started        32 WerFault.exe 15->32         started        34 svchost.exe 17->34         started        36 cmd.exe 17->36         started        38 WerFault.exe 17->38         started        97 179.43.171.217, 80 PLI-ASCH Panama 19->97 99 127.0.0.1 unknown unknown 19->99 145 Changes security center settings (notifications, updates, antivirus, firewall) 19->145 40 5 other processes 19->40 file5 signatures6 process7 file8 81 C:\Users\user\AppData\Roaming\VERSION.dll, PE32+ 22->81 dropped 83 C:\Users\user\...\CiscoSparkLauncher.dll, PE32+ 22->83 dropped 85 C:\Users\user\AppData\...\CiscoCollabHost.exe, PE32+ 22->85 dropped 87 3 other malicious files 22->87 dropped 113 Contains functionality to bypass UAC (CMSTPLUA) 22->113 115 Contains functionality to start a terminal service 22->115 117 Sample is not signed and drops a device driver 22->117 119 2 other signatures 22->119 42 svchost.exe 4 22->42         started        46 cmd.exe 1 22->46         started        48 WerFault.exe 16 22->48         started        50 conhost.exe 30->50         started        52 schtasks.exe 30->52         started        54 conhost.exe 36->54         started        56 schtasks.exe 36->56         started        58 conhost.exe 40->58         started        signatures9 process10 file11 89 C:\Users\user\AppData\Local\...behaviorgraphxtuum.exe, PE32 42->89 dropped 121 Antivirus detection for dropped file 42->121 123 Multi AV Scanner detection for dropped file 42->123 125 Contains functionality to start a terminal service 42->125 127 Contains functionality to inject code into remote processes 42->127 60 Gxtuum.exe 42->60         started        129 Uses schtasks.exe or at.exe to add and modify task schedules 46->129 63 schtasks.exe 1 46->63         started        65 conhost.exe 46->65         started        signatures12 process13 signatures14 147 Antivirus detection for dropped file 60->147 149 Multi AV Scanner detection for dropped file 60->149 151 Contains functionality to start a terminal service 60->151 67 CiscoCollabHost.exe 63->67         started        process15 signatures16 109 Contains functionality to start a terminal service 67->109 70 svchost.exe 67->70         started        73 cmd.exe 67->73         started        75 WerFault.exe 67->75         started        process17 signatures18 111 Contains functionality to start a terminal service 70->111 77 conhost.exe 73->77         started        79 schtasks.exe 73->79         started        process19
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmhtduv7gf4fct6qcvw2d56twjugxlnxxw6y3ayqgtwfw4y2cj7q._file
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:fb3c97 discovery execution persistence trojan
Link:
https://tria.ge/reports/250322-1zj4ws1vhw/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Amadey
Amadey family
Malware Config
C2 Extraction:
http://179.43.171.217
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

PowerShell (PS) ps1 5b0f31d2bf3178514fd0156da1f7d3b2686badb7bdbd8d831034ec5b731a127f

(this sample)

Amadey

Executable exe 986388d72f34752697292d7ab098b2f8ba064c44224df8f4edb777aa01622688

  
Link
https://tria.ge/250206-v1jlvstkbl/behavioral1
  
Delivery method
Distributed via web download
  
Dropping
SHA256 986388d72f34752697292d7ab098b2f8ba064c44224df8f4edb777aa01622688
  
Dropping
MD5 254dd4a350fccb7cb271703417bb79de

Comments


Avatar
commented on 2025-03-22 22:18:39 UTC

Mistaken with another sample:

Amadey Botnet: fb3c97
Amadey C2: http://179.43.171.217/b9kdj3s3C0/index.php