🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb
SHA3-384 hash: 95507881b5c18061cd57304d1da7981c098c5a103f583375f523bd9ee6cbf204e381e321ab4ab72ac237343355e889b0
SHA1 hash: 615f757f0f5ea8307627f0974f14e1b04b0b09f8
MD5 hash: 54c4ebab32a69b047745a0d943fa3e6c
humanhash: texas-april-moon-vermont
File name:54c4ebab32a69b047745a0d943fa3e6c.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:1'932'288 bytes
First seen:2025-03-07 15:44:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'861 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 24576:GBFo9aGC2QnjHQYzZtCiBQWIxH4/YoDsLsOXE8twivg0u+OftuqCbqmKkQt0Is+c:GB3WyntC6+ZL11weHuPsmk5lfggyYur
TLSH T10395336A1E19ACB2C449877E588E7F4965FD240126AFC90E0966DE67F83FF1D123C078
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
426
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
54c4ebab32a69b047745a0d943fa3e6c.exe
Verdict:
Malicious activity
Analysis date:
2025-03-07 19:06:50 UTC
Tags:
amadey botnet stealer opendir loader purecrypter purelogs lumma telegram vidar rdp themida stealc java auto generic
Link:
https://app.any.run/tasks/610a6299-5885-4796-bf61-01d80f645cb6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67cb1581c668b65489bfda3c
Tags:
autorun spawn small hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Creating a file
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
crypt microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/67cb14953c5f644bd94809e3/reports/a1e3f060-56ee-4692-b8ae-c6ab7d711dcf/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/af451ece-eadb-45d6-896e-2c6ee8ff5a35
Result
Threat name:
Amadey, Credential Flusher, GCleaner, Lu
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1632137
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Credential Flusher
Yara detected GCleaner
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1632137 Sample: AaxpYFDQ32.exe Startdate: 07/03/2025 Architecture: WINDOWS Score: 100 81 45.91.200.135 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Netherlands 2->81 83 strawpeasaen.fun 2->83 85 38 other IPs or domains 2->85 113 Suricata IDS alerts for network traffic 2->113 115 Found malware configuration 2->115 117 Malicious sample detected (through community Yara rule) 2->117 119 18 other signatures 2->119 9 rapes.exe 4 40 2->9         started        14 AaxpYFDQ32.exe 5 2->14         started        16 4bcefcec83.exe 2->16         started        18 4 other processes 2->18 signatures3 process4 dnsIp5 107 176.113.115.6, 49681, 49682, 49684 SELECTELRU Russian Federation 9->107 109 176.113.115.7, 49683, 49687, 49692 SELECTELRU Russian Federation 9->109 69 C:\Users\user\AppData\...\a026d51e13.exe, PE32 9->69 dropped 71 C:\Users\user\AppData\...\3353aa7d43.exe, PE32 9->71 dropped 73 C:\Users\user\AppData\...\2009d9de82.exe, PE32 9->73 dropped 79 11 other malicious files 9->79 dropped 153 Contains functionality to start a terminal service 9->153 155 Creates multiple autostart registry keys 9->155 157 Hides threads from debuggers 9->157 20 c2f48edf32.exe 9->20         started        23 4bcefcec83.exe 9->23         started        26 a026d51e13.exe 9->26         started        32 4 other processes 9->32 75 C:\Users\user\AppData\Local\...\rapes.exe, PE32 14->75 dropped 77 C:\Users\user\...\rapes.exe:Zone.Identifier, ASCII 14->77 dropped 159 Detected unpacking (changes PE section rights) 14->159 161 Tries to evade debugger and weak emulator (self modifying code) 14->161 163 Tries to detect virtualization through RDTSC time measurements 14->163 28 rapes.exe 14->28         started        111 23.197.127.21 AKAMAI-ASN1EU United States 16->111 165 Query firmware table information (likely to detect VMs) 16->165 167 Found many strings related to Crypto-Wallets (likely being stolen) 16->167 169 Tries to harvest and steal ftp login credentials 16->169 175 2 other signatures 16->175 171 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->171 173 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->173 30 firefox.exe 18->30         started        file6 signatures7 process8 dnsIp9 121 Antivirus detection for dropped file 20->121 123 Detected unpacking (changes PE section rights) 20->123 139 6 other signatures 20->139 34 BitLockerToGo.exe 33 20->34         started        95 defaulemot.run 104.21.112.1, 443, 49703 CLOUDFLARENETUS United States 23->95 97 orangemyther.live 104.21.64.1 CLOUDFLARENETUS United States 23->97 125 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->125 127 Query firmware table information (likely to detect VMs) 23->127 141 2 other signatures 23->141 129 Tries to detect sandboxes and other dynamic analysis tools (window names) 26->129 143 4 other signatures 26->143 131 Multi AV Scanner detection for dropped file 28->131 133 Contains functionality to start a terminal service 28->133 135 Tries to evade debugger and weak emulator (self modifying code) 28->135 99 youtube.com 216.58.206.46 GOOGLEUS United States 30->99 101 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 30->101 105 5 other IPs or domains 30->105 38 firefox.exe 30->38         started        40 firefox.exe 30->40         started        103 steamcommunity.com 104.73.234.102, 443, 49691 AKAMAI-ASUS United States 32->103 137 Binary is likely a compiled AutoIt script file 32->137 145 2 other signatures 32->145 42 5a20da7e37.exe 32->42         started        45 taskkill.exe 32->45         started        47 taskkill.exe 32->47         started        49 5 other processes 32->49 signatures10 process11 dnsIp12 87 185.156.73.73, 49697, 80 RELDAS-NETRU Russian Federation 34->87 61 C:\Users\user\AppData\Local\...\Y-Cleaner.exe, PE32 34->61 dropped 63 C:\Users\user\...\Bunifu_UI_v1.5.3.dll, PE32 34->63 dropped 65 C:\Users\user\AppData\Local\...\soft[1], PE32 34->65 dropped 67 C:\Users\user\AppData\Local\...\dll[1], PE32 34->67 dropped 89 sterpickced.digital 104.21.16.1, 443, 49694, 49702 CLOUDFLARENETUS United States 42->89 91 garagedrootz.top 104.21.48.1 CLOUDFLARENETUS United States 42->91 93 2 other IPs or domains 42->93 147 Query firmware table information (likely to detect VMs) 42->147 149 Found many strings related to Crypto-Wallets (likely being stolen) 42->149 151 Tries to steal Crypto Currency Wallets 42->151 51 conhost.exe 45->51         started        53 conhost.exe 47->53         started        55 conhost.exe 49->55         started        57 conhost.exe 49->57         started        59 conhost.exe 49->59         started        file13 signatures14 process15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb/
Threat name:
Win32.Ransomware.Amadey
Create hunting rule
Status:
Malicious
First seen:
2025-03-06 13:08:30 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qcjk564ngcriln7yjdvfzdqyeao5fvvmvltgwam2etb7n7e7z7fq._file
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:asyncrat family:lumma family:stealc family:stormkitty botnet:092155 botnet:traff1 credential_access defense_evasion discovery execution pyinstaller rat spyware stealer trojan upx
Link:
https://tria.ge/reports/250307-s66x8ssrw2/
Behaviour
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Scheduled Task/Job: Scheduled Task
Modifies system certificate store
Modifies data under HKEY_USERS
Enumerates system info in registry
Checks processor information in registry
System Location Discovery: System Language Discovery
Program crash
Enumerates physical storage devices
Detects Pyinstaller
Command and Scripting Interpreter: PowerShell
Browser Information Discovery
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates processes with tasklist
Suspicious use of SetThreadContext
UPX packed file
Looks up external IP address via web service
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Loads dropped DLL
Identifies Wine through registry keys
Executes dropped EXE
Drops startup file
Checks computer location settings
Checks BIOS information in registry
Uses browser remote debugging
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Suspicious use of NtCreateUserProcessOtherParentProcess
Stormkitty family
StormKitty payload
StormKitty
Stealc family
Stealc
Lumma family
Lumma Stealer, LummaC
Asyncrat family
AsyncRat
Amadey family
Amadey
Malware Config
C2 Extraction:
http://176.113.115.6
https://fostinjec.today/api
https://begindecafer.world/api
https://garagedrootz.top/api
https://modelshiverd.icu/api
https://arisechairedd.shop/api
https://6catterjur.run/api
https://orangemyther.live/api
https://sterpickced.digital/api
https://agroecologyguide.digital/api
https://explorebieology.run/api
https://kmoderzysics.top/api
https://seedsxouts.shop/api
https://rcodxefusion.top/api
https://farfinable.top/api
https://techspherxe.top/api
https://cropcircleforum.today/api
https://codxefusion.top/api
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bc29fc0e-fa12-41f3-a7a8-81851b621c4e
Unpacked files
SH256 hash:
8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb
MD5 hash:
54c4ebab32a69b047745a0d943fa3e6c
SHA1 hash:
615f757f0f5ea8307627f0974f14e1b04b0b09f8
Link:
https://www.unpac.me/results/55022eef-4173-46a9-b424-ea75e7448c95/
SH256 hash:
41d68e2a228a1cf46ccdd681c8d9005e4c7b1cb903ed6d11a31d79d59befba1e
MD5 hash:
6790c74e89c47e54b8aa0853abe298e4
SHA1 hash:
b32bea21ed1409adf603e8f9ab14ee8cef7c0cdc
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/55022eef-4173-46a9-b424-ea75e7448c95/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8092aefb8d30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments