MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492
SHA3-384 hash: a374aaf4e89543364850450996836be74b10f976ee450af6997b3331f30bf94dfc5002766cc47854f828dcf510f89cb5
SHA1 hash: fc62cfa4c9949f32e9627fdc8f594e94662c61b5
MD5 hash: 00ecf5354e6fb6ddd33d4c3cd5e14463
humanhash: quiet-muppet-item-don
File name:00ecf5354e6fb6ddd33d4c3cd5e14463.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:225'280 bytes
First seen:2023-04-24 21:50:18 UTC
Last seen:2023-05-13 22:39:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 88e77976ee88242bd495e2b66bf3b0c1 (3 x Amadey, 1 x RedLineStealer)
ssdeep 3072:LYPem9FABIZr05LqT/6JeLECzdhgMYNB2tndulyzphHe//KWQeLJnaCG5BW:Ly3ABW2meJNEdyz2vulyd/WjG5
Threatray 284 similar samples on MalwareBazaar
TLSH T1BE2409217D16C032C565917629F9BFF2C19CA8269BB049DB7B800F7BDA112F72970E39
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://myserveur855.cc/8bmeVwqx/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
257
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
setup.exe
Verdict:
Malicious activity
Analysis date:
2023-04-22 01:02:47 UTC
Tags:
loader smoke trojan amadey
Link:
https://app.any.run/tasks/ba35ac04-9af4-43ac-9780-11423684a520

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/384636/
Detection(s):
SecuriteInfo.com.Variant.Barys.321153.32461.32752.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending an HTTP POST request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Creating a process from a recently created file
Creating a file
Enabling the 'hidden' option for files in the %temp% directory
Launching a process
Changing a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% directory
Creating a window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/81280/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware shell32.dll
Link:
https://www.filescan.io/uploads/6446f9c7809528e43aab2f1f/reports/457090ea-cfaa-471d-be7c-9349484003f3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73df93b4-1efc-4b0a-8964-b5d8c5ac4b3f
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1220312
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Very long command line found
Yara detected Amadey bot
Yara detected Amadeys stealer DLL
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 853258 Sample: QQlwa499op.exe Startdate: 24/04/2023 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic 2->42 44 Found malware configuration 2->44 46 Antivirus detection for URL or domain 2->46 48 8 other signatures 2->48 10 QQlwa499op.exe 17 2->10         started        process3 dnsIp4 38 myserveur855.cc 85.217.144.114, 49700, 49702, 49703 WS171-ASRU Bulgaria 10->38 40 x0.at 167.235.245.18, 443, 49701 ALBERTSONSUS United States 10->40 54 Contains functionality to inject code into remote processes 10->54 14 cmd.exe 1 10->14         started        signatures5 process6 signatures7 56 Very long command line found 14->56 17 cmd.exe 2 14->17         started        21 conhost.exe 14->21         started        process8 file9 36 C:\Users\user\AppData\Local\...\PBQB.cmd.exe, PE32 17->36 dropped 50 Very long command line found 17->50 23 PBQB.cmd.exe 15 17->23         started        26 conhost.exe 17->26         started        signatures10 process11 signatures12 52 Adds a directory exclusion to Windows Defender 23->52 28 powershell.exe 3 23->28         started        30 powershell.exe 3 23->30         started        process13 process14 32 conhost.exe 28->32         started        34 conhost.exe 30->34         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2023-04-22 04:58:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nfjgw33jykd2jlwzqrxgmnkhdtuyoi6mt4fp7a47nirngefgcsja._file
Verdict:
malicious
Similar samples:
1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b
Amadey
4d6a68af9d1de9ad0ed6dfdd5cbb0daa6341caa3798b26b3d2d111d06fc402ba
Amadey
579532a04b63aac5992010d56fa6cc982855b194d9782f5cfff3b063192a94d0
Amadey
857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1
Amadey
8a59fe8ca31ce4abde54d02705f65ed0d788e384e0d5c05441971f4d1fef5b34
Amadey
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5
Amadey
bf7d44466f19258fb2ef69b1b945e9795c2afaeeea01294a2c30d996a78b64ca
Amadey
d6674af0eeb02b8fd4723c1d79aef8e84541da7460b49ae7ad4f89d7d49c4000
Amadey
+ 274 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey trojan
Link:
https://tria.ge/reports/230424-1qgbmsge7x/
Behaviour
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Amadey
Malware Config
C2 Extraction:
myserveur855.cc/8bmeVwqx/index.php
Unpacked files
SH256 hash:
69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492
MD5 hash:
00ecf5354e6fb6ddd33d4c3cd5e14463
SHA1 hash:
fc62cfa4c9949f32e9627fdc8f594e94662c61b5
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/6c8c843e-2a4d-424e-946e-bf459cc5898e/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/69526b6f69c2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69526b6f69c287a4aed9846e6635471ce98723cc9f0aff839f6a22d310a61492

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:win_amadey_a9f4
Create hunting rule
Author:Johannes Bader
Description:matches unpacked Amadey samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/384636/

Comments