MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8437af9312fa3a3f5ed17a5b1877502024832eb2b050fb93566389817c47f551. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8437af9312fa3a3f5ed17a5b1877502024832eb2b050fb93566389817c47f551
SHA3-384 hash: 93adf9445390ac1e31ac26b8caaa1660c497a63bd6a5fee92ef355bf6e1e88eacd1a21e108bc772c6e3a7891fe928a53
SHA1 hash: d4da2c09653f529183aaf0cd9262af3dd32f6819
MD5 hash: 534011e44589ccb05a3927dcee2320a9
humanhash: illinois-pluto-princess-ohio
File name:cred.bin
Download: download sample
Signature Amadey
Create hunting rule
File size:125'440 bytes
First seen:2020-10-02 07:25:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 13b5131cc6d9e1cc15e361292ef29fba (1 x Amadey)
ssdeep 3072:gO5WEWgTfyLiz9qBCnchKSNPoD6qV8IqWSF29:gO5mgDyLizECz7WIF
TLSH 67C34B73F1C18872D0790E7C9C5AD298AA2EFE612D38156BB6E44F0D4D3A2C16D6C6C7
Reporter JAMESWT_WT
Tags:Amadey

Intelligence

File Origin
# of uploads :
1
# of downloads :
787
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67638/
Detection(s):
Win.Malware.Zusy-9753108-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
phis.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/479982
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Amadey\'s stealer DLL
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8437af9312fa3a3f5ed17a5b1877502024832eb2b050fb93566389817c47f551/
Threat name:
Win32.Trojan.PswStealer
Create hunting rule
Status:
Malicious
First seen:
2020-05-03 03:48:13 UTC
File Type:
PE (Dll)
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qq327eys7i5d6xwrpjnrq52qeasiglvswbipxe2wmoeyc7ch6viq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201002-3ba42qvqxn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Unpacked files
SH256 hash:
8437af9312fa3a3f5ed17a5b1877502024832eb2b050fb93566389817c47f551
MD5 hash:
534011e44589ccb05a3927dcee2320a9
SHA1 hash:
d4da2c09653f529183aaf0cd9262af3dd32f6819
Link:
https://www.unpac.me/results/881affd0-9795-4352-8499-1c31b9891b21/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8437af9312fa3a3f5ed17a5b1877502024832eb2b050fb93566389817c47f551

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

DLL dll 8437af9312fa3a3f5ed17a5b1877502024832eb2b050fb93566389817c47f551

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/67638/
  
URLhaus
https://urlhaus.abuse.ch/url/322135/
  
Delivery method
Distributed via web download

Comments