MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e24caf0355d2816bec83ce942643a52213d676f5ebf03f2ff40d46c2af8ce21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 1 File information Comments

SHA256 hash:	7e24caf0355d2816bec83ce942643a52213d676f5ebf03f2ff40d46c2af8ce21
SHA3-384 hash:	fa4eb8fadb1ddf6ec68eab384674f6b18c0e1162080d16805da52fda332d2895f03057a4b7119432cc310f01e5ab41bb
SHA1 hash:	0ad015065304467a659575eca8e322485982eda2
MD5 hash:	2e42b0bed4d0228cde60b27436b54eef
humanhash:	early-victor-alpha-edward
File name:	2e42b0bed4d0228cde60b27436b54eef.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	282'112 bytes
First seen:	2022-10-10 17:58:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ae11519a6eac288b6a17a0c03e5a652c (10 x Smoke Loader, 2 x GCleaner, 1 x DanaBot)
ssdeep	3072:uXrN9JMhlH3THrjUggq5fbn8+F2XNrEuZ29rBFrDv2i2bC0QhOM/h3qpZa9uD6Vq:2Z9JMTHbEYbnOXWNzr7HHhOrwVfquS
TLSH	T13E54BF317641CCB2C00626704419DFA06B7EED3559B89A473B6C2B6E6F7728066FA31F
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	38b078cccacccc53 (62 x Smoke Loader, 25 x Stop, 21 x RedLineStealer)
Reporter	abuse_ch
Tags:	Amadey exe

abuse_ch

Amadey C2:
167.235.71.14:20469

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
167.235.71.14:20469	https://threatfox.abuse.ch/ioc/872735/

Intelligence

File Origin

# of uploads :

# of downloads :

390

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/318613/

Detection(s):

Win.Malware.Azorult-9949206-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/42329/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CPUID_Instruction

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

azorult greyware

Link:

https://www.filescan.io/uploads/63445d67979fe5ad3328afae/reports/24405bc8-1488-496d-ac9d-8b887f20c507/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a2be2a25-98a5-4806-9552-c79ce7d0df79

Result

Threat name:

Amadey, RedLine, SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1087122

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e24caf0355d2816bec83ce942643a52213d676f5ebf03f2ff40d46c2af8ce21/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-10-10 17:59:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pysmv4bvluubnpwihtuuezb2kiqt2z3pl27qh4x7idkgykxyzyqq._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor discovery persistence spyware stealer trojan

Link:

https://tria.ge/reports/221010-wkqkxachel/

Behaviour

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Detects Smokeloader packer

SmokeLoader

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7e24caf0355d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7e24caf0355d2816bec83ce942643a52213d676f5ebf03f2ff40d46c2af8ce21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.