MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9
SHA3-384 hash: d4290babc93702de89b0789e4b3cf83110c2fa8057ef9ef8673e411516c889e6b775d56baf8d4bf775ad5a7a415acbf3
SHA1 hash: d5aaeb94ec0d92bd9aa7d4b76860e9c25cf10ee2
MD5 hash: 098e15e88e5332253356c78badf8d479
humanhash: solar-lamp-uniform-bravo
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:3'037'032 bytes
First seen:2024-09-20 03:50:27 UTC
Last seen:2024-10-01 16:56:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ffb6d212ec0eddd03980d3d9bade33c6 (1 x Amadey)
ssdeep 49152:PqRtSgOLEJxW+BmNlgtTTqEva2+qb6Xy3gIYvfe2radRo8ap5XAnZ2JarsW:VgaEJxlBolgtCEvZuXyQbUzozXAnZUW
Threatray 1 similar samples on MalwareBazaar
TLSH T1D6E59CA17997C82FC15B0270881DC2ED7262BC329EA14947BBC4B77E5A74F43471EE29
TrID 64.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
11.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.FON) Windows Font (5545/9/1)
5.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon a1c0b290d072b0b0 (1 x Amadey)
Reporter Bitsight
Tags:45-202-35-101 Amadey exe


Avatar
Bitsight
url: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300

Intelligence

File Origin
# of uploads :
3
# of downloads :
501
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9
Verdict:
Malicious activity
Analysis date:
2024-09-18 15:24:23 UTC
Tags:
amadey botnet stealer
Link:
https://app.any.run/tasks/48c1fcc0-7af8-4a9d-b091-cd1667bd342c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.W32.GenKryptik.HBUB.tr.3677.8584.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ecf128f129e67ada90143a
Tags:
Encryption Infostealer Network Static Stealth
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Сreating synchronization primitives
Connection attempt
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc lolbin microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/66ecf1280883d6a903ecdb86/reports/d3d9a6b7-fad7-4b9c-98fd-c5893eb90580/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7229c3ba-8b2f-41bf-936c-644991b8c81f
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1514321
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected unpacking (creates a PE file in dynamic memory)
Drops large PE files
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Behaviour
Behavior Graph:
Download SVG
Score:
4%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2024-09-18 10:53:59 UTC
File Type:
PE (Exe)
Extracted files:
122
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=noe437qnh26jbgko4vskvsoirmg7qdzfoifo3lp7myfa2b422deq._file
Verdict:
malicious
Label(s):
amadey
Create hunting rule
Similar samples:
6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9
Amadey
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:550eb4 discovery persistence trojan
Link:
https://tria.ge/reports/240920-eegx5sxeql/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Adds Run key to start application
Amadey
Malware Config
C2 Extraction:
http://45.202.35.101
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/910064b4-8ee3-46e3-b4cb-fe3c0fc612a6
Unpacked files
SH256 hash:
ce454e5b930a58d7fd4872a89300d4caa961673108e6540637583bb1c9c8c66e
MD5 hash:
6d1511a0234cb1ec08e1137cc5bec8ce
SHA1 hash:
f0ba1d411653d4ba9eaa8cfcc36637e94952dd41
Detections:
Amadey
Create hunting rule
win_amadey_auto
Create hunting rule
win_amadey
Create hunting rule
Link:
https://www.unpac.me/results/28c12214-d69b-4f79-90e5-dc70e664af2a/
SH256 hash:
6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9
MD5 hash:
098e15e88e5332253356c78badf8d479
SHA1 hash:
d5aaeb94ec0d92bd9aa7d4b76860e9c25cf10ee2
Link:
https://www.unpac.me/results/28c12214-d69b-4f79-90e5-dc70e664af2a/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6b89cdfe0d3e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_APT29_WINELOADER_Backdoor
Create hunting rule
Author:daniyyell
Description:Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 6b89cdfe0d3ebc90994ee564aac9c88b0df80f25720aedadff660a0d079ad0c9

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3181988/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WinExec
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetFileAttributesW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::EmptyClipboard
USER32.dll::OpenClipboard
USER32.dll::CreateWindowExW

Comments