MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments 1

SHA256 hash:	7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4
SHA3-384 hash:	a99d39b263e6d1d2b0e43289ac4800fd9f4ed58496c489a3a07a9bc1d501087cc606cd7d90a71d6b49cbee3c31869253
SHA1 hash:	7c8a18a80ba96c3944462f3a68e63b55da0e1bf4
MD5 hash:	d4ca12f7203548519be8455bd836274f
humanhash:	single-ceiling-snake-thirteen
File name:	d4ca12f7203548519be8455bd836274f
Download:	download sample
Signature	Amadey Create hunting rule
File size:	129'024 bytes
First seen:	2022-02-12 22:05:05 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	557f0c64436e04f97f66ceeb0911cbf0 (34 x Amadey)
ssdeep	3072:ox7p5EJTJG/DL5nr0Z2fgnXKSxN07IXauEedimjA29:ox781G/DJ0Z2fjgrEeL
Threatray	80 similar samples on MalwareBazaar
TLSH	T1CFC36B73F1D08872D0B10E7CAD5AE6D8663EFE202C251557B6E94E4C6D3B6C2296C6C3
Reporter	zbetcheckin
Tags:	32 Amadey dll exe

Intelligence

File Origin

# of uploads :

# of downloads :

384

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/241122/

Detection(s):

Win.Malware.Zusy-9753108-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey greyware stealer zusy

Link:

https://www.filescan.io/uploads/62082f18289e2f3e4fcc60f1/reports/4f0ec555-6044-41c6-bf60-eb75f98e57ac/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/88f38c0a-d069-4025-8a44-9c2886b51d2b

Result

Threat name:

Amadey

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/938874

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Call by Ordinal

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected Amadeys stealer DLL

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4/

Threat name:

Win32.Infostealer.Decred

Status:

Malicious

First seen:

2022-02-10 11:02:43 UTC

File Type:

PE (Dll)

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Verdict:

malicious

Amadey

0456056c570a6e91167dbbcf46a074d6cb2ba1d11f8913cbc58c31ea0e641be6

Amadey

134ed27da9f9e727a3e6b4c551655d93f4e18969836ae94f0d59ddae09bbd0d1

Amadey

1c783c06aa669b0133618672069fba39409a6eda891e48e172d679ed0c1e8fef

Amadey

3ab15fc67fb3c40fbe6921267824cb715e1f6a79de9f3bfc4a0db5bd77b1bce8

Amadey

944bf821a0bb44e9fb1c6a220bf692603e3e51a08b64757fb1891c990f43eb88

Amadey

cf54b511bbad6d75020546c730cd46274f1189b94ed61767a8ca51f238ea6117

Amadey

f09df3f39ce69391315e9f4691b03febb175aed9fca886080f905f51670fd581

Amadey

+ 70 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

collection spyware stealer

Link:

https://tria.ge/reports/220212-1zj4wsdbg7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_win_path

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Reads local data of messenger clients

Unpacked files

SH256 hash:

7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

MD5 hash:

d4ca12f7203548519be8455bd836274f

SHA1 hash:

7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

Link:

https://www.unpac.me/results/c907e56b-7d31-4a61-b197-63511c45e3c8/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exec_macros Create hunting rule
Author:	ddvvmmzz
Description:	exec macros

Rule name:	INDICATOR_TOOL_PWS_Amady Create hunting rule
Author:	ditekSHen
Description:	Detects password stealer DLL. Dropped by Amadey

Rule name:	obfuscate_macros Create hunting rule
Author:	ddvvmmzz
Description:	obfuscate macros

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

DLL dll 7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/241122/

URLhaus

https://urlhaus.abuse.ch/url/2041865/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-02-12 22:05:08 UTC

url : hxxp://185.215.113.35/d2VxjasuwS/Plugins/cred.dll