MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ca339f9bf73ef302951d7ea7ef6089ab670c82e98837b8c684a2591c611b6fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ca339f9bf73ef302951d7ea7ef6089ab670c82e98837b8c684a2591c611b6fd
SHA3-384 hash: 35bc005f31d5bba45cac65deac922d6be3362a1dc98e8d0ad7b63ba34dab7c058b16526aeffccb619197b53b4e5591dc
SHA1 hash: c28852b73f5474b5cc36300565e9e0421504c41f
MD5 hash: 46672b613240b1852a28ac267c01b9ef
humanhash: aspen-hotel-social-artist
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:2'733'778 bytes
First seen:2023-03-25 23:34:46 UTC
Last seen:2023-03-27 05:34:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f6baa5eaa8231d4fe8e922a2e6d240ea (36 x CoinMiner, 22 x DCRat, 15 x LummaStealer)
ssdeep 49152:705hsKY/Pc+pbQJZ/awaeCdIoe1QWzdvLQBREUsrmAuJS272g9UU:705hsBXMr/aSCqZLpLQBR7AuMW2q
Threatray 26 similar samples on MalwareBazaar
TLSH T102C5336337F28DB4D67329B094C055720EF7D9382F2249CFA5243E2585B9ACA95BF342
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.6% (.EXE) Win64 Executable (generic) (10523/12/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon c025814b661d4900 (1 x Amadey)
Reporter andretavare5
Tags:Amadey exe


Avatar
andretavare5
Sample downloaded from https://vk.com/doc791620691_661118169?hash=5zZHq2ERchl6nAbDw1Uz7LQXqd094bkQZzC40DrD4fs&dl=G44TCNRSGA3DSMI:1679771484:zi3tiRSQU49Q9rm5YH2758scqvk0R26edlsLSacMt0H&api=1&no_preview=1#1143

Intelligence

File Origin
# of uploads :
8
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-03-25 23:35:27 UTC
Tags:
trojan amadey loader
Link:
https://app.any.run/tasks/18d8f7a3-5857-4817-93b6-b8ab3c0869c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/377458/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Replacing files
Launching cmd.exe command interpreter
Sending an HTTP POST request
DNS request
Adding an access-denied ACE
Sending a custom TCP request
Sending an HTTP GET request
Searching for analyzing tools
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/74895/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
keylogger overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/641f85288f3f4544f6cc0bee/reports/5ba20a16-cbcf-4955-ad5c-5b15d0d78057/overview
Verdict:
Malicious
Labled as:
Trojan.Stealer
Link:
https://www.hybrid-analysis.com/sample/7ca339f9bf73ef302951d7ea7ef6089ab670c82e98837b8c684a2591c611b6fd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97712a31-c4df-458c-a2c1-63c5eb713b61
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1201982
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Instant Messenger accounts or passwords
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 834887 Sample: file.exe Startdate: 26/03/2023 Architecture: WINDOWS Score: 100 89 Snort IDS alert for network traffic 2->89 91 Malicious sample detected (through community Yara rule) 2->91 93 Antivirus detection for URL or domain 2->93 95 7 other signatures 2->95 12 file.exe 8 2->12         started        16 oneetx.exe 2->16         started        process3 file4 65 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 12->65 dropped 67 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 12->67 dropped 107 Contains functionality to register a low level keyboard hook 12->107 18 cmd.exe 2 12->18         started        signatures5 process6 process7 20 Amadey.exe 3 18->20         started        24 7z.exe 2 18->24         started        26 7z.exe 3 18->26         started        28 7 other processes 18->28 file8 61 C:\Users\user\AppData\Local\...\oneetx.exe, PE32 20->61 dropped 97 Contains functionality to inject code into remote processes 20->97 30 oneetx.exe 20 20->30         started        63 C:\Users\user\AppData\Local\...\Amadey.exe, PE32 24->63 dropped signatures9 process10 dnsIp11 79 88.218.60.230, 49698, 49699, 49700 E-STYLEISP-ASRU Russian Federation 30->79 69 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32+ 30->69 dropped 71 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 30->71 dropped 73 C:\Users\user\AppData\Local\...\cred64[1].dll, PE32+ 30->73 dropped 75 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 30->75 dropped 81 Multi AV Scanner detection for dropped file 30->81 83 Creates an undocumented autostart registry key 30->83 85 Machine Learning detection for dropped file 30->85 87 Uses schtasks.exe or at.exe to add and modify task schedules 30->87 35 rundll32.exe 30->35         started        37 cmd.exe 1 30->37         started        39 schtasks.exe 1 30->39         started        41 rundll32.exe 30->41         started        file12 signatures13 process14 process15 43 rundll32.exe 35->43         started        47 conhost.exe 37->47         started        49 cmd.exe 1 37->49         started        51 cmd.exe 1 37->51         started        55 4 other processes 37->55 53 conhost.exe 39->53         started        dnsIp16 77 192.168.2.1 unknown unknown 43->77 99 System process connects to network (likely due to code injection or exploit) 43->99 101 Tries to steal Instant Messenger accounts or passwords 43->101 103 Tries to harvest and steal ftp login credentials 43->103 105 Tries to harvest and steal browser information (history, passwords, etc) 43->105 57 tar.exe 43->57         started        signatures17 process18 process19 59 conhost.exe 57->59         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ca339f9bf73ef302951d7ea7ef6089ab670c82e98837b8c684a2591c611b6fd/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=psrtt6n7opxtakkr27vh55qitk3hbsbotcbxxddijiszdrqrw36q._file
Verdict:
malicious
Similar samples:
0efc37cca6f7e2b5405daf5431a093ae479527635ab2cd64b1e9a582a4095ffe
Amadey
15e5d0f3035ddeb19ab45120c125c41d02a4317757d8a67c8545a31826d4b5a9
Amadey
64aca7057a61b52f8630a3e5e312efd0c0a2004c1596cdef29d483f8e97b346a
Amadey
8a1057cf8e0ae58585534119e5edb46f5de02b2119edf91e77a0b24a045596de
Amadey
94b3d313ee97663b116a32bcb8e4368a15913482601a564ce7f1986c74cde043
Amadey
+ 16 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:redline botnet:7 evasion infostealer spyware stealer trojan
Link:
https://tria.ge/reports/230325-3kzxxagg5x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
RedLine
Malware Config
C2 Extraction:
88.218.60.230/7vzZwkv2/index.php
89.22.237.107:44745
Unpacked files
SH256 hash:
71eff711d78fb255cb5dc80532d35f96e504ea23c3b3512fb32cec3293082409
MD5 hash:
6622f7ad732df2cf05a24360acebb967
SHA1 hash:
4c992f0f59361d348d8ab3679794f8225c942495
Link:
https://www.unpac.me/results/2bd08495-71bd-4796-b8dd-cc9cb0ce8a8a/
SH256 hash:
7ca339f9bf73ef302951d7ea7ef6089ab670c82e98837b8c684a2591c611b6fd
MD5 hash:
46672b613240b1852a28ac267c01b9ef
SHA1 hash:
c28852b73f5474b5cc36300565e9e0421504c41f
Link:
https://www.unpac.me/results/2bd08495-71bd-4796-b8dd-cc9cb0ce8a8a/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7ca339f9bf73/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ca339f9bf73ef302951d7ea7ef6089ab670c82e98837b8c684a2591c611b6fd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/377458/

Comments