MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3
SHA3-384 hash: 6c0bc7366fdbb976b0fe5dc26d2791211bc8a77437485a6e10d882d457b8d3b46b23cf32e0d935439fce58e1aefca915
SHA1 hash: d37e4d6677e756b0ce9fe465da30f5ad90df3673
MD5 hash: add55267c4300ac8cc1a238c52d4de38
humanhash: skylark-timing-alpha-uniform
File name:add55267c4300ac8cc1a238c52d4de38.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:1'357'824 bytes
First seen:2023-03-02 02:40:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 24576:Qy+ysNIZ9w1nvHTHmP2in7J2dgeQ2yVSZeoh92SApfm7xUb/ZxnJp:XdTynvHDG2i7Jj2kid9HmO7xi/fn
Threatray 4'180 similar samples on MalwareBazaar
TLSH T1AE55230BA2DD8435E8F413B0A8F683930632BD518B38875BA35F6D185CB35A1E6753B7
TrID 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
193.56.146.11:4162

Intelligence

File Origin
# of uploads :
1
# of downloads :
255
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
add55267c4300ac8cc1a238c52d4de38.exe
Verdict:
Malicious activity
Analysis date:
2023-03-02 02:43:09 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/d3a8994a-632c-4872-a612-deec46d6411d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/370996/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

Win.Packed.Disabler-9987080-0
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a custom TCP request
Creating a file
Connecting to a non-recommended domain
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Unauthorized injection to a recently created process
Blocking the Windows Defender launch
Disabling the operating system update service
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
advpack.dll anti-vm CAB installer packed rundll32.exe setupapi.dll shell32.dll stealer
Link:
https://www.filescan.io/uploads/64000cbe0e8ce4beca257db4/reports/a4b507bf-83cb-4e9e-8e49-a0a697085e41/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/942c9cc5-7af7-4764-a64b-286636eda350
Result
Threat name:
Amadey, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1185408
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Amadeys stealer DLL
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 818264 Sample: L0VG499Ftc.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 100 76 Snort IDS alert for network traffic 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Antivirus detection for dropped file 2->80 82 9 other signatures 2->82 11 L0VG499Ftc.exe 1 4 2->11         started        14 rundll32.exe 2->14         started        16 rundll32.exe 2->16         started        18 4 other processes 2->18 process3 file4 62 C:\Users\user\AppData\...\ptlg6426lv.exe, PE32 11->62 dropped 64 C:\Users\user\AppData\...\jxeX84Qq75.exe, PE32 11->64 dropped 20 ptlg6426lv.exe 1 4 11->20         started        process5 file6 50 C:\Users\user\AppData\...\ptOR9010Pj.exe, PE32 20->50 dropped 52 C:\Users\user\AppData\...\hk25Jq68ZU17.exe, PE32 20->52 dropped 84 Multi AV Scanner detection for dropped file 20->84 86 Machine Learning detection for dropped file 20->86 24 ptOR9010Pj.exe 1 4 20->24         started        signatures7 process8 file9 58 C:\Users\user\AppData\...\ptCs8619Zy.exe, PE32 24->58 dropped 60 C:\Users\user\AppData\...\gnSf98kL96.exe, PE32 24->60 dropped 92 Multi AV Scanner detection for dropped file 24->92 94 Machine Learning detection for dropped file 24->94 28 ptCs8619Zy.exe 1 4 24->28         started        signatures10 process11 file12 66 C:\Users\user\AppData\...\ptJu6920Sf.exe, PE32 28->66 dropped 68 C:\Users\user\AppData\...\fr58dg7719sy.exe, PE32 28->68 dropped 110 Multi AV Scanner detection for dropped file 28->110 112 Machine Learning detection for dropped file 28->112 32 ptJu6920Sf.exe 1 4 28->32         started        signatures13 process14 file15 46 C:\Users\user\AppData\...\ptpV2685CK.exe, PE32 32->46 dropped 48 C:\Users\user\AppData\...\dsUd35Uq36.exe, PE32 32->48 dropped 72 Multi AV Scanner detection for dropped file 32->72 74 Machine Learning detection for dropped file 32->74 36 ptpV2685CK.exe 1 4 32->36         started        signatures16 process17 file18 54 C:\Users\user\AppData\...\cuIP69TR05.exe, PE32 36->54 dropped 56 C:\Users\user\AppData\...\beUF03jF53.exe, PE32 36->56 dropped 88 Multi AV Scanner detection for dropped file 36->88 90 Machine Learning detection for dropped file 36->90 40 cuIP69TR05.exe 5 36->40         started        44 beUF03jF53.exe 9 1 36->44         started        signatures19 process20 dnsIp21 70 193.56.146.11, 4162, 49698 LVLT-10753US unknown 40->70 96 Multi AV Scanner detection for dropped file 40->96 98 Detected unpacking (changes PE section rights) 40->98 100 Detected unpacking (overwrites its own PE header) 40->100 108 4 other signatures 40->108 102 Machine Learning detection for dropped file 44->102 104 Disable Windows Defender notifications (registry) 44->104 106 Disable Windows Defender real time protection (registry) 44->106 signatures22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-03-01 23:48:30 UTC
File Type:
PE (Exe)
Extracted files:
294
AV detection:
20 of 25 (80.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6sl6fv4ogytitdeyfmicz6boy27peayqmmftdaoa3mrygckxpbq._file
Verdict:
malicious
Similar samples:
32d3cdae010be4cb4bbff8ee5f714de9bd61f22d587490c1dec81d09c13dd137
Amadey
3cba07617efd2d904eaa0ae1366b89725a24f9dd98aa5b8d5ba8eadfcf06fec7
Amadey
3d5d9d09b31291e45a7a9f800ff333e4dcb71ede5a0e5d885b24fabbbd23cd97
Amadey
460e1e4d125b25fd5e9449c2abf40cdf0752d51e6b5590224f64db57a35b4209
Amadey
464cb61d0b4d1cd242594533f64d81c6e0363ee6b55fc9611ff0fe0c53e01a15
Amadey
7eec73213a062b0517adcd97ffe5f9b8257282d644eb31a7a2d5f1c8cb32bc19
Amadey
8a6339b6e79033962ce34c39670d3c7cd45550fb23b64338fd3e816bb867b76f
Amadey
c8e418a9972b8750c050b6ff4a61172b44c20acc6fd6c21d5e948f98d3389268
Amadey
d3b2b84b23f79bdf4f9250be0c88d082fed6e142d857fe2a96e4cbe5504aea5d
Amadey
fe0af7fa6a03abf75d47059ef6c846638095f260f911bfab6945d2980c98d289
Amadey
+ 4'170 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:redline botnet:fuba botnet:rouch discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/230302-c6ewraag8y/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Amadey
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine payload
Malware Config
C2 Extraction:
193.56.146.11:4162
193.233.20.14/BR54nmB3/index.php
Unpacked files
SH256 hash:
6cf67d2968b38cbcbe6022d1a3940fd80c88a129a8bf28c6f37e4a2f6939e497
MD5 hash:
7ec79075b6f5a617f20bfcec31948573
SHA1 hash:
b84c47b996833a941e156a63cfe1cdff877b548a
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
Parent samples :
b61e024c0314aae27d06e3213a9fbc24e2a3d77959b24600f75a95c61df848ff
ef20f567ece486a5df8e04c2b23949619b6a777092b6c5e4f70a7fc812b22459
bd4d978fa4d4235102b82e6a56867082673bfe1bb7e491e71786fdf9c8203b12
886661aad6c5a156202a50d30412770401829118c532c77e4e19dc9ab67704d3
4f3c12637e6b2404b9195f7e271a84b635fa619e1b4227aa95dca5bc2b36f5b1
e1d2b602a3df088de970c32c04b73168447fad6f867dfad97e7e17e8d5e7dc63
7fe05268c8e8fd080b2365e422a5e461dc3f6b0256539f56c9076b46e0864346
34b0124a6f6a07277c39071121d8787a6b16bd1fc42caf0ae9941f6830e3748b
6038c93d03ea7ac3ba06d90888b8417446d73710b84e489749efdae975f7a63d
18610f0c5f8676474a4b2d84610ef53f043f12076ee2f7d35f4634987bf2943c
32cfa5c51c80084472c6db199d719f0ace2ecde3c84bd1269d8cf70783026f76
30ec02c0f220c0781c72fb574ec9069e183e09f3ce7507f422f576f8678b08a6
2d4d3eba8eaeb76e915edc3a5a235fca8b21355a2e96e453d1dd125716580eae
9f469c8d9fab26312cc357c19fb194c8f3e38aa57e8e25a3d3ed535499d2a9c8
dc9b97ce9fce93129638cb82fbac4b4dd4d21703e28b6b6ca6a7b8fa212e2b03
8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3
cec60a5d68763377103cb5aebf90bf7a58c5e29e6ac733df706f0dbcc23fa989
18ca53d02cb94d582414eea83bd7e86e918a16a797b6a35e5ee7ae1e490a6892
de2690627ed44301b19cb6b83d6c197f117ad3e7f890ebe9d6dae5d19c30a669
41e0fdcd838127aef48516dc8734c56c4e47779378a6a44989eb36a82fc63237
f0c96b7317e111c847255fa91e6a99e45b4e5a42cc72e5cb0bc520b62560b7e8
18e5990f45511e155c2409e9d5dbebd229ad58c3cf1ca484dc6ae089bb525850
95ed5a3f53b68c7b008ea1cf6b72b27a36abf5cd87ca4f0a59fab1a9b92b0a58
74a5102ccd518e3ccddb2d7e918f84bdf3050078d53fef8eab8581c9b405a0e4
9a45b049d4e5ffcfd9bdd27cf23e88cd21d11ff28a6eef7bca6f71abd86eb4b0
c057850344a23fddd2577d073c708dfb8effda80821b5e1426b9efc5456caecc
3898fbb3f5229dae50c9c51a8a571220f5166f44b12aff131d9227da487156ed
271b979057da170866b007e766e5ed91bc7a1cb095d90963c5d20498e3b50cae
a406b6a41cad101dcebcb5b5e983b82d39e4f24b5eb622fc1cc87eb6f167a0fc
292d49b35338ec0ef22bc276cb6d336669da61043c903ad37c785b0cd280b2e1
cb83bf4573cd176036205c64395d5b1c63ae55de2510f8cfec12909064251e23
c9382162c12508314a11c589a4cea55685cd731a3af8ea3e44544ebf2766777c
430fbb691520a8a81286a9964073f61a966e34a44e96fafe1d4ec2623c5d0a6f
d2e679662af4ea8e85e50d634283726b21b6620a0345eca3be9e6f8bcdf6bad9
80ab0bb9c21d958b5f5d784c50e31cc2565a097fb07af33ac409baa13691dd9a
63b533b240cf3ecc65465d339f0079f577a456fc708b209359f5bc79d0428743
ae6a2e0bd22b3fe00d16f7b560530e609db7e9ba643fc9327545feabcf18fd91
1d9025518d933dc7bcb96348b0f18fb8219e4b403f08cad0cb1f98c2dc36d6f3
07e57266f1c6808343472603967cc87f599afac3cac36b7fcc74494db164b2cc
9ef6038931db15742431b5f4a809d1bd738e6a7704c13b146da61c5aa5d76fed
e1ef227e9460948c8330838f9a690e0f2a8ccc17d6507a3ec9c30507cc508b8f
d295dcb92d0336178482fd3b774a7a4ee36d066720d31270259953c1952f57ef
83442e0469de6bca5f73a5bfed396b3d1eac38b61e2366e7b2d407feb3a6d9fa
0fd7f1e8aaed6a9f06cee09f60cc5e3d0eff30cdcd02af642f19b758c216706d
826abb2c7460a2fdfac87867ec25d52893f97a7008d16438ec39956f469ef1c8
8690edb3e04b54cea621611b2f05a45a6aebcf9aab95bb5f3b3ae850cb0b1fcd
3bc0e6f80e05bbf4fb2be1ca4c52c74bb777bc1112b72cd6cc1dff05f3c9ef4f
481fded2f1220c8e5ee605b95949a5351c7486206b5acfb6809979164282b4a4
7ca570abf699afaf13c97f3c9af686dc61a02aff010ea286c9085d9992bb9468
ee22a97bba340681e3c0a5e48453a4d4f2a9b12357ac088efd6a688a181cca39
83fce427a4473a925a2c512271b31f424c4468669d363b19f6f52d5ced22c693
631606fbbf4126ed8db651af755fb8c0b2130c0f14e7b1dc60dd06fa7cb29c73
a55203d2a11f77404b7789cc7e7df4573b5c2df073f635d033129796788970c9
2907a31d705b1e8abf16c618c4718295cda87151be30ce8a0d59c082ac4d0b1f
440dfd8d43964c75db1865fb960fafbf68201141586bd13456faa8f5f94a4974
a5ac747b222ad3f50dc1125757bbb99193e84a2adaee3f1d3ac2a1932635af1b
38335d1c12c313646a3aa279c3448ff517acda6b20e472e90c544553a5d633be
8d82d706e740b03a9c1d4d390ea343723d5c09c7c5749c9f1100f93298e45511
c4af6fdeb3bbde1f87e5b2a59cf0c1b9151754c7e2bd72329bbf49206d905cd6
a0d004fb08a4183800e0e4d741edcf6dbb4aafb6a3710ee00dfa2fd0506ce5c0
755d7321420f9afac09ee2cbba1b6d0692e796027ddbe3f52c03f2c1f80203cf
6f5bf4afea063b5b6052a88cc7bb3d11030f19b27db397fbcb39f56d1b1cdc0c
2911f273eb4cc25174a69122e6b72efc5ac329cad43ac0ec00424e69a0c07875
8e7668b6c618b3467a75aff03d23440d7ed42553841a151263898929185866a0
bea5d7fd4a9655aca8eb49f54d702871adc0c1f667d950aac396f20026c60090
857c2e32867182bf357bed31e07f4597996c268b73844617e750a53efc74fc38
191317a1c4803470a1a6b48b35c7cd580c01010f079a59614546dc0895a28e72
d0042be94b2cea68e112457e2e91a8f375fd69e7e50db66a7547e5f0207449e3
0148c1982ca95ee411a88bf2a7635a731b11030547d9ae761937c33324656f82
ea5aa739b4e95d86b19d2f3a1f332cc56463093c93861e7386bcf3b8d651d6c5
9975fe4a93e94f7ed87e3a3f4df97135e3440f872fbc89c6f116c75ca2ed0428
50b5ea8a319a9c973c4e6cefaa9e403d04fa790dbf7ef2041d5915fe88b12ae7
34a898a8144a775c89c4e6a89378e6f265fad2d8ac4e5c554faab570f988100b
890b890ca61f36ab3c96f2c092e0bfb6a50fcea564ac3ec1aedb10015efd53bc
d9e58b2eb4b8cc3558b28bd2e7a76ad8d482b71dffbb759866a1f3e0d53e8fd3
cd069d0eb0bbced0adf950f6706e72bf14764997cea5a79ce796ed5d466ed71a
9a6f96ce63a10717a58cf6efc4a1070faa4328c9df3cf73e5191ee0e85c75298
f02b0ba32340836ea6598bb438689d8857d51f373cba860a8f6ae40a5ef418be
SH256 hash:
7ac6c9770fecbc0095676215b38a5229f5959c691e651ff0c51c9a4c298bc366
MD5 hash:
4e2607b793ca08bec5ba5a82f7a1d7ca
SHA1 hash:
b827bb58e4d31c65c22f3aac272abc4e39432f9d
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
SH256 hash:
6c0a664dc5b6141af13fc379d3b973e1c9cd6a949f0f6627a1f3d61acc9c693b
MD5 hash:
732146c8704062be706a38daead0f1aa
SHA1 hash:
6983b1e19cf35221223b73e66aeeff5350d4d234
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
Parent samples :
b61e024c0314aae27d06e3213a9fbc24e2a3d77959b24600f75a95c61df848ff
4f3c12637e6b2404b9195f7e271a84b635fa619e1b4227aa95dca5bc2b36f5b1
e1d2b602a3df088de970c32c04b73168447fad6f867dfad97e7e17e8d5e7dc63
34b0124a6f6a07277c39071121d8787a6b16bd1fc42caf0ae9941f6830e3748b
6038c93d03ea7ac3ba06d90888b8417446d73710b84e489749efdae975f7a63d
32cfa5c51c80084472c6db199d719f0ace2ecde3c84bd1269d8cf70783026f76
dc9b97ce9fce93129638cb82fbac4b4dd4d21703e28b6b6ca6a7b8fa212e2b03
8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3
18ca53d02cb94d582414eea83bd7e86e918a16a797b6a35e5ee7ae1e490a6892
de2690627ed44301b19cb6b83d6c197f117ad3e7f890ebe9d6dae5d19c30a669
18e5990f45511e155c2409e9d5dbebd229ad58c3cf1ca484dc6ae089bb525850
95ed5a3f53b68c7b008ea1cf6b72b27a36abf5cd87ca4f0a59fab1a9b92b0a58
9a45b049d4e5ffcfd9bdd27cf23e88cd21d11ff28a6eef7bca6f71abd86eb4b0
c057850344a23fddd2577d073c708dfb8effda80821b5e1426b9efc5456caecc
3898fbb3f5229dae50c9c51a8a571220f5166f44b12aff131d9227da487156ed
271b979057da170866b007e766e5ed91bc7a1cb095d90963c5d20498e3b50cae
292d49b35338ec0ef22bc276cb6d336669da61043c903ad37c785b0cd280b2e1
cb83bf4573cd176036205c64395d5b1c63ae55de2510f8cfec12909064251e23
c9382162c12508314a11c589a4cea55685cd731a3af8ea3e44544ebf2766777c
430fbb691520a8a81286a9964073f61a966e34a44e96fafe1d4ec2623c5d0a6f
d2e679662af4ea8e85e50d634283726b21b6620a0345eca3be9e6f8bcdf6bad9
80ab0bb9c21d958b5f5d784c50e31cc2565a097fb07af33ac409baa13691dd9a
ae6a2e0bd22b3fe00d16f7b560530e609db7e9ba643fc9327545feabcf18fd91
07e57266f1c6808343472603967cc87f599afac3cac36b7fcc74494db164b2cc
d295dcb92d0336178482fd3b774a7a4ee36d066720d31270259953c1952f57ef
0fd7f1e8aaed6a9f06cee09f60cc5e3d0eff30cdcd02af642f19b758c216706d
8690edb3e04b54cea621611b2f05a45a6aebcf9aab95bb5f3b3ae850cb0b1fcd
ee22a97bba340681e3c0a5e48453a4d4f2a9b12357ac088efd6a688a181cca39
83fce427a4473a925a2c512271b31f424c4468669d363b19f6f52d5ced22c693
631606fbbf4126ed8db651af755fb8c0b2130c0f14e7b1dc60dd06fa7cb29c73
a55203d2a11f77404b7789cc7e7df4573b5c2df073f635d033129796788970c9
2907a31d705b1e8abf16c618c4718295cda87151be30ce8a0d59c082ac4d0b1f
8d82d706e740b03a9c1d4d390ea343723d5c09c7c5749c9f1100f93298e45511
c4af6fdeb3bbde1f87e5b2a59cf0c1b9151754c7e2bd72329bbf49206d905cd6
a0d004fb08a4183800e0e4d741edcf6dbb4aafb6a3710ee00dfa2fd0506ce5c0
755d7321420f9afac09ee2cbba1b6d0692e796027ddbe3f52c03f2c1f80203cf
2911f273eb4cc25174a69122e6b72efc5ac329cad43ac0ec00424e69a0c07875
d0042be94b2cea68e112457e2e91a8f375fd69e7e50db66a7547e5f0207449e3
50b5ea8a319a9c973c4e6cefaa9e403d04fa790dbf7ef2041d5915fe88b12ae7
890b890ca61f36ab3c96f2c092e0bfb6a50fcea564ac3ec1aedb10015efd53bc
9a6f96ce63a10717a58cf6efc4a1070faa4328c9df3cf73e5191ee0e85c75298
SH256 hash:
ff223847df276fe027c4f819a2e37eaf8a6a71d1f371452085c472b0176ad92c
MD5 hash:
921f99629e431c08c2eb487a1d90c3d5
SHA1 hash:
d86259e598f49d698bd64d091844d74407e110e4
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
SH256 hash:
7d4d0f3cd16bf06ffdce5e1eafd0a55f68080a138716ddf56fb4bc523ddf20be
MD5 hash:
46f02f5669a4dbaa27d235cda57e5fb3
SHA1 hash:
75e5f120135094c8595c15b91600d319c25bbab6
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
SH256 hash:
c2f7e94c525fba0923bded91d2e3f4f07e26fb6f3ed4d571c18a57d35cc9dd96
MD5 hash:
ced6df2388f163ebcd5e00f7274855d3
SHA1 hash:
3e4f227bd9f0984056a08b4378e5c8d42ce66b59
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
SH256 hash:
3b3f9eb9dacba777896c0e73a0b51b3b71c2a53b171ee0a44ac97b4c63ec0cbd
MD5 hash:
2c0940d7a64b598592e52630ae29b76f
SHA1 hash:
cdf177cf95654f37afd7292b8f0e3450d70abc93
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
Parent samples :
7fe05268c8e8fd080b2365e422a5e461dc3f6b0256539f56c9076b46e0864346
8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3
SH256 hash:
8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3
MD5 hash:
add55267c4300ac8cc1a238c52d4de38
SHA1 hash:
d37e4d6677e756b0ce9fe465da30f5ad90df3673
Link:
https://www.unpac.me/results/40cc192e-8055-4aab-863d-64c0443aec5c/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8fa4bf16bc71/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 8fa4bf16bc71b1344c64c1588167c17635f790188318598c0e06d91c184abbc3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2551757/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/370996/

Comments