MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 863842faf56e4baa908875007919fae85b968d574453a72ccea51ef0c7b97342. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 863842faf56e4baa908875007919fae85b968d574453a72ccea51ef0c7b97342
SHA3-384 hash: d669a945c9ba18839ce9d851fe648913bf84fc343cb3c40654b8385bc33baf3f21e8926639f8d899d836d11901e74d33
SHA1 hash: 352d2571b1dbd4d4da5f53873b74cb9501216c47
MD5 hash: c53f5ca1fc3606b4412ca6bb5cf4b14c
humanhash: london-carbon-minnesota-skylark
File name:c53f5ca1fc3606b4412ca6bb5cf4b14c.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:288'768 bytes
First seen:2021-08-19 17:35:38 UTC
Last seen:2021-08-19 18:56:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c373d93df8b60680e045175a45030767 (7 x Amadey, 2 x Glupteba, 2 x DanaBot)
ssdeep 6144:doX665Y5qYKJwXgt57xl++l4z0nU4ptXV+wVsM3c6:SJAqYiwXgt576+l4z96XlI6
Threatray 1'010 similar samples on MalwareBazaar
TLSH T16F547D20B690C035E4A613F469BA83AD6B28BDB45B2450DF63D637EE57346E49C3027F
dhash icon ead8a89cc6e68ee0 (43 x RaccoonStealer, 31 x RedLineStealer, 20 x Smoke Loader)
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://185.215.113.206/k8FppT/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.215.113.206/k8FppT/index.php https://threatfox.abuse.ch/ioc/192171/

Intelligence

File Origin
# of uploads :
2
# of downloads :
333
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c53f5ca1fc3606b4412ca6bb5cf4b14c.exe
Verdict:
No threats detected
Analysis date:
2021-08-19 17:36:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/37ada2a2-b312-4f36-98d7-4d70eba25cdb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/180755/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.62008.23105.6694.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Creating a process from a recently created file
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f1fded3-5ec3-4266-8b81-29e6bcce8674
Result
Threat name:
Amadey RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/835955
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 468386 Sample: d99Ca6D5HA.exe Startdate: 19/08/2021 Architecture: WINDOWS Score: 100 78 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->78 80 Found malware configuration 2->80 82 Antivirus detection for URL or domain 2->82 84 9 other signatures 2->84 10 d99Ca6D5HA.exe 2->10         started        13 ddrfdvh 2->13         started        15 hnbux.exe 2->15         started        17 hnbux.exe 2->17         started        process3 signatures4 116 Detected unpacking (changes PE section rights) 10->116 118 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->118 120 Maps a DLL or memory area into another process 10->120 19 explorer.exe 7 10->19 injected 122 Machine Learning detection for dropped file 13->122 124 Checks if the current machine is a virtual machine (disk enumeration) 13->124 126 Creates a thread in another existing process (thread injection) 13->126 process5 dnsIp6 64 193.142.59.134, 49727, 49743, 49753 HOSTSLICK-GERMANYNL Netherlands 19->64 66 193.142.59.248, 49733, 80 HOSTSLICK-GERMANYNL Netherlands 19->66 68 4 other IPs or domains 19->68 54 C:\Users\user\AppData\Roaming\ddrfdvh, PE32 19->54 dropped 56 C:\Users\user\AppData\Local\Temp\3719.exe, PE32 19->56 dropped 58 C:\Users\user\AppData\Local\Temp\1102.exe, PE32 19->58 dropped 60 C:\Users\user\...\ddrfdvh:Zone.Identifier, ASCII 19->60 dropped 94 System process connects to network (likely due to code injection or exploit) 19->94 96 Benign windows process drops PE files 19->96 98 Deletes itself after installation 19->98 100 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->100 24 96CF.exe 4 19->24         started        28 63D7.exe 14 27 19->28         started        31 3719.exe 19->31         started        33 1102.exe 15 3 19->33         started        file7 signatures8 process9 dnsIp10 62 C:\Users\user\AppData\Local\...\hnbux.exe, PE32 24->62 dropped 102 Detected unpacking (changes PE section rights) 24->102 35 hnbux.exe 14 24->35         started        72 188.124.36.242, 25802, 49761 SELECTELRU Russian Federation 28->72 74 api.ip.sb 28->74 104 Query firmware table information (likely to detect VMs) 28->104 106 Tries to detect sandboxes and other dynamic analysis tools (window names) 28->106 108 Tries to harvest and steal browser information (history, passwords, etc) 28->108 114 2 other signatures 28->114 39 conhost.exe 28->39         started        110 Machine Learning detection for dropped file 31->110 112 Contains functionality to infect the boot sector 31->112 76 185.215.113.29, 8889 WHOLESALECONNECTIONSNL Portugal 33->76 41 conhost.exe 33->41         started        file11 signatures12 process13 dnsIp14 70 185.215.113.206, 49762, 49763, 49764 WHOLESALECONNECTIONSNL Portugal 35->70 86 Detected unpacking (changes PE section rights) 35->86 88 Machine Learning detection for dropped file 35->88 90 Contains functionality to inject code into remote processes 35->90 92 Uses schtasks.exe or at.exe to add and modify task schedules 35->92 43 cmd.exe 35->43         started        45 schtasks.exe 35->45         started        signatures15 process16 process17 47 reg.exe 43->47         started        50 conhost.exe 43->50         started        52 conhost.exe 45->52         started        signatures18 128 Creates an undocumented autostart registry key 47->128
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/863842faf56e4baa908875007919fae85b968d574453a72ccea51ef0c7b97342/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-08-19 17:36:13 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qy4ef6xvnzf2veeiouahsgp25bnzndkxirj2olgouuppbr5zonba._file
Verdict:
suspicious
Similar samples:
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed
Amadey
23d94c5414f81f6736b4ddc3cdc26097fb66d839d00079aa1c87c40a7e726cf9
Amadey
271ef3d1c323cc5e26fc653259ee79c6c06cf38509c37b0d669710841a60f5a6
Amadey
328e682510e9c0e0c37a7c8d347ecb4e7791a03b44962675a3f5f23d85250e08
Amadey
39326cdd0c863e1766ecc3d119ec18fdaa93ef886cfbc887f76784f745df73e4
Amadey
516b8716bfbbd056ec8259f0c336e855b0fed7dbaaa6c04ec76aa1328c92ad87
Amadey
5345e44552a14502cc5f4d6e7bca0ebf222cda847905ae1d29effa24750c0250
Amadey
79f1ba97a20bfba399809b1af714574feba04b72dfc88aea23051b462f75455c
Amadey
c7839db336f11c965ab8e6fbad1a6c757711a24362cc20d63d4ce37aef9b83b1
Amadey
dfae191d0f324a74e03fe2b99f10a2a33daca3ede5b2f226db8d4905d76414ef
Amadey
+ 1'000 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader backdoor discovery infostealer persistence trojan
Link:
https://tria.ge/reports/210819-pc1a7t56se/
Behaviour
Checks SCSI registry key(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Modifies file permissions
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
SmokeLoader
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.29:8889
Unpacked files
SH256 hash:
18cd8e90fcd46329480f24d43baa489683b3ee2fcd274bf1714947ef307a6ab2
MD5 hash:
f2fecf6872ad4c61a3a506159fddd4fc
SHA1 hash:
28e039eb96dcf58841992280c66433a2bbab8e84
Link:
https://www.unpac.me/results/25ddb7ea-7152-4748-ab50-3603506fb8d0/
SH256 hash:
863842faf56e4baa908875007919fae85b968d574453a72ccea51ef0c7b97342
MD5 hash:
c53f5ca1fc3606b4412ca6bb5cf4b14c
SHA1 hash:
352d2571b1dbd4d4da5f53873b74cb9501216c47
Link:
https://www.unpac.me/results/25ddb7ea-7152-4748-ab50-3603506fb8d0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/863842faf56e4baa908875007919fae85b968d574453a72ccea51ef0c7b97342

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 863842faf56e4baa908875007919fae85b968d574453a72ccea51ef0c7b97342

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1545011/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1533747/
Cape
Cape
https://www.capesandbox.com/analysis/180755/

Comments