🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 16


Intelligence 16 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4
SHA3-384 hash: 7a46471c3d8aa99848d3669c7279393ea11997d3548fe6bbb879053d53be8a4752ff085047c74b4f1007639f8d5666ea
SHA1 hash: 39f2454fcdd5ffd812034b5e3b8b7183722214ec
MD5 hash: 582f90039d305a4706f8556ac74dcb90
humanhash: zebra-aspen-five-fillet
File name:582f90039d305a4706f8556ac74dcb90.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:2'142'208 bytes
First seen:2025-02-11 17:15:16 UTC
Last seen:2025-02-11 18:44:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'861 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:27q0TCDwnj9crYAsY9/2bg4+nJ7bBpO17ydJQHHuwv:uzpnj2rR9/2hyHe7YO
Threatray 1 similar samples on MalwareBazaar
TLSH T143A523588CED331ED75BAC7B58070A3B5B6BACB88C85D0D7AD4E22723D93E814A0553D
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
483
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
95d87424384bed2b8798668d45a7380dba16af93592624047007cdf47672a03a
Verdict:
Malicious activity
Analysis date:
2025-02-11 14:54:58 UTC
Tags:
amadey botnet stealer loader stealc themida tas17 cryptbot gcleaner telegram arch-exec auto vidar generic redline smoke lumma lefthook exfiltration github opendir antivm credentialflusher autoit
Link:
https://app.any.run/tasks/68aeab4d-79ba-4f77-91dd-bdd3badfbbf1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.17048.23990.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ab85d16ddd91410accda5e
Tags:
vmdetect autorun
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Creating a file
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm crypt microsoft_visual_cc obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67ab85d5c0f303a5682d8795/reports/9c124d0e-d836-42cf-93ef-07a1acc70ed7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/79f7e5ac-0dd4-4878-87d2-16e41314789b
Result
Threat name:
Amadey, AsyncRAT, Healer AV Disabler, Lu
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1612327
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates HTA files
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Drops PE files with a suspicious file extension
Found API chain indicative of sandbox detection
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Powershell drops PE file
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell download and execute file
Sigma detected: PowerShell DownloadFile
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Search for Antivirus process
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to download and execute files (via powershell)
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Yara detected Amadey
Yara detected Amadeys stealer DLL
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Yara detected Healer AV Disabler
Yara detected LummaC Stealer
Yara detected obfuscated html page
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1612327 Sample: DhqvS8pXj8.exe Startdate: 11/02/2025 Architecture: WINDOWS Score: 100 139 toppyneedus.biz 2->139 141 suggestyuoz.biz 2->141 143 8 other IPs or domains 2->143 159 Suricata IDS alerts for network traffic 2->159 161 Found malware configuration 2->161 163 Malicious sample detected (through community Yara rule) 2->163 165 37 other signatures 2->165 11 skotes.exe 2 57 2->11         started        16 DhqvS8pXj8.exe 5 2->16         started        18 afccf6841f.exe 2->18         started        20 7 other processes 2->20 signatures3 process4 dnsIp5 145 185.215.113.16, 49742, 49754, 49766 WHOLESALECONNECTIONSNL Portugal 11->145 147 185.215.113.43, 49737, 49738, 49741 WHOLESALECONNECTIONSNL Portugal 11->147 149 185.215.113.75, 49739, 49790, 49819 WHOLESALECONNECTIONSNL Portugal 11->149 111 C:\Users\user\AppData\Local\...\Fe36XBk.exe, PE32 11->111 dropped 113 C:\Users\user\AppData\Local\...\7fOMOTQ.exe, PE32 11->113 dropped 115 C:\Users\user\AppData\Local\...\L5shRfh.exe, PE32 11->115 dropped 123 20 other malicious files 11->123 dropped 211 Creates multiple autostart registry keys 11->211 213 Hides threads from debuggers 11->213 215 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->215 217 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 11->217 22 afccf6841f.exe 1 11->22         started        26 cmd.exe 11->26         started        28 dc785309cb.exe 11->28         started        38 3 other processes 11->38 117 C:\Users\user\AppData\Local\...\skotes.exe, PE32 16->117 dropped 119 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 16->119 dropped 219 Detected unpacking (changes PE section rights) 16->219 221 Tries to evade debugger and weak emulator (self modifying code) 16->221 223 Tries to detect virtualization through RDTSC time measurements 16->223 30 skotes.exe 16->30         started        121 C:\Users\user\AppData\Local\...\wucgjnAiS.hta, HTML 18->121 dropped 225 Binary is likely a compiled AutoIt script file 18->225 227 Creates HTA files 18->227 32 mshta.exe 18->32         started        34 cmd.exe 18->34         started        229 Multi AV Scanner detection for dropped file 20->229 231 Suspicious powershell command line found 20->231 233 Machine Learning detection for dropped file 20->233 235 2 other signatures 20->235 36 cmd.exe 20->36         started        40 4 other processes 20->40 file6 signatures7 process8 file9 105 C:\Users\user\AppData\Local\...\2C3I1mD9d.hta, HTML 22->105 dropped 175 Binary is likely a compiled AutoIt script file 22->175 177 Machine Learning detection for dropped file 22->177 179 Found API chain indicative of sandbox detection 22->179 42 mshta.exe 1 22->42         started        45 cmd.exe 1 22->45         started        52 2 other processes 26->52 47 cmd.exe 28->47         started        181 Multi AV Scanner detection for dropped file 30->181 183 Detected unpacking (changes PE section rights) 30->183 199 5 other signatures 30->199 185 Suspicious powershell command line found 32->185 187 Tries to download and execute files (via powershell) 32->187 50 powershell.exe 32->50         started        54 2 other processes 34->54 107 C:\Temp\i2GY6vn5L.hta, HTML 36->107 dropped 189 Creates HTA files 36->189 56 2 other processes 36->56 191 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 38->191 193 Writes to foreign memory regions 38->193 195 Allocates memory in foreign processes 38->195 197 Injects a PE file into a foreign processes 38->197 58 3 other processes 38->58 60 3 other processes 40->60 signatures10 process11 file12 201 Suspicious powershell command line found 42->201 203 Tries to download and execute files (via powershell) 42->203 62 powershell.exe 15 18 42->62         started        205 Drops PE files with a suspicious file extension 45->205 207 Uses schtasks.exe or at.exe to add and modify task schedules 45->207 76 2 other processes 45->76 131 C:\Users\user\AppData\...\Macromedia.com, PE32 47->131 dropped 66 Macromedia.com 47->66         started        78 11 other processes 47->78 133 TempOBIIERT8JWKOKQBWJVVZGBZ2TJW54YEP.EXE, PE32 50->133 dropped 68 TempOBIIERT8JWKOKQBWJVVZGBZ2TJW54YEP.EXE 50->68         started        70 conhost.exe 50->70         started        135 C:\Temp\v468GkyBl.hta, HTML 52->135 dropped 209 Creates HTA files 52->209 72 mshta.exe 52->72         started        80 6 other processes 52->80 74 powershell.exe 56->74         started        137 C:\ProgramData\jhbbvnx\fbpbh.exe, PE32 58->137 dropped signatures13 process14 file15 125 TempMHLZAGA5NZFMG2ZDILNZW0CTFV5YR4HM.EXE, PE32 62->125 dropped 237 Powershell drops PE file 62->237 82 TempMHLZAGA5NZFMG2ZDILNZW0CTFV5YR4HM.EXE 62->82         started        85 conhost.exe 62->85         started        127 C:\Users\user\AppData\...\AchillesGuard.com, PE32 66->127 dropped 129 C:\Users\user\AppData\...\AchillesGuard.js, ASCII 66->129 dropped 239 Drops PE files with a suspicious file extension 66->239 87 schtasks.exe 66->87         started        241 Detected unpacking (changes PE section rights) 68->241 243 Tries to detect sandboxes and other dynamic analysis tools (window names) 68->243 245 Machine Learning detection for dropped file 68->245 251 4 other signatures 68->251 247 Suspicious powershell command line found 72->247 249 Tries to download and execute files (via powershell) 72->249 89 powershell.exe 72->89         started        92 powershell.exe 80->92         started        94 powershell.exe 80->94         started        96 powershell.exe 80->96         started        signatures16 process17 file18 151 Detected unpacking (changes PE section rights) 82->151 153 Machine Learning detection for dropped file 82->153 155 Modifies windows update settings 82->155 157 7 other signatures 82->157 98 conhost.exe 87->98         started        109 C:\Users\...\483d2fa8a0d53818306efeb32d3.exe, PE32 89->109 dropped 100 483d2fa8a0d53818306efeb32d3.exe 89->100         started        103 conhost.exe 89->103         started        signatures19 process20 signatures21 167 Detected unpacking (changes PE section rights) 100->167 169 Tries to evade debugger and weak emulator (self modifying code) 100->169 171 Hides threads from debuggers 100->171 173 2 other signatures 100->173
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4/
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-02-11 15:11:49 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oz3ci7jbz7vkgyxuixisvymylw3rhzu7lg6vcl5w22nxyoh26x2a._file
Verdict:
malicious
Label(s):
amadey
Create hunting rule
Similar samples:
7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4
Amadey
error
Amadey
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:lumma botnet:9c9aa5 defense_evasion discovery execution spyware stealer trojan
Link:
https://tria.ge/reports/250211-vsrbqstncr/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates processes with tasklist
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Amadey family
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
http://185.215.113.43
https://timnelessdesign.cyou/api
Verdict:
Malicious
Tags:
win32_amadey
YARA:
n/a
Link:
https://app.threat.zone/submission/25bfda19-668f-421c-9f33-76097a2eb513
Unpacked files
SH256 hash:
7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4
MD5 hash:
582f90039d305a4706f8556ac74dcb90
SHA1 hash:
39f2454fcdd5ffd812034b5e3b8b7183722214ec
Link:
https://www.unpac.me/results/c05bebcb-0562-4ad2-be73-973c4875836e/
SH256 hash:
b888a8d633808e11be66d14996e152bfcf0ab9fec7daabd4a169b89bc8f671fd
MD5 hash:
7b1480c67c92f1e485859d5bbf2c8176
SHA1 hash:
29fecdad1cb67f13ab1dc5016dce3daac829d22f
Detections:
Amadey
Create hunting rule
win_amadey
Create hunting rule
Link:
https://www.unpac.me/results/c05bebcb-0562-4ad2-be73-973c4875836e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7676247d21cfeaa362f445d12ae1985db713e69f59bd512fb6d69b7c38faf5f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_1f2e969c
Create hunting rule
Author:Elastic Security
Rule name:win_amadey_a9f4
Create hunting rule
Author:Johannes Bader
Description:matches unpacked Amadey samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments