MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9024874d28bb97920f3ec5edad7e5e3f1fb9184fb38176abfa167fa7a2cb42f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 9

Intelligence 9 IOCs YARA 28 File information Comments

SHA256 hash:	9024874d28bb97920f3ec5edad7e5e3f1fb9184fb38176abfa167fa7a2cb42f9
SHA3-384 hash:	5e9db88f9b6ebd982073fcbd2fc8a6f1441fa63991b2ba8e2d18ceca17af2e2be04be3c764e4dc347b7a4e1a7e4847ff
SHA1 hash:	feb0b3768c25a2a2a1e7b50821644503b20db480
MD5 hash:	65d4468189505bb4d791c4341c645033
humanhash:	uranus-papa-california-undress
File name:	SETUP.zip
Download:	download sample
Signature	Amadey Create hunting rule
File size:	10'754'719 bytes
First seen:	2025-04-29 11:39:54 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:1ynCinKkAZYgmFVrW9B1bNqifykWRtJRGguBb2HZf9cB6R1TWW2A+:ICcvWYvWb1pqCgiuTWF
TLSH	T1ABB63362E39094EEC23D077949E36B71BBB6D03642F722865B3650696DB23453D30FCA
Magika	zip
Reporter	aachum
Tags:	Amadey file-pumped LummaStealer zip

iamaachum

https://filespayout.cfd/?3HEwqRQ8yn0oSaNgLYk6zxpb2fUhdmTOtisJAXvI=ZGeiH09YIOmsW2Ty4PQ3ucEwnpL8SoxrkAMaXR7jD1F=hjx3mFOQpJ6XlIe4ZArHivVTnYN59LyMSg0DU8uEacwbKt7&p_title=Adobe-Premiere-Pro-2024-Build-24-2-Crack---Serial-Key-Download&h=40 => https://mega.nz/file/s4hjTQzK#jevbJrnG7VnTrCJLjZnKq-dfq1pfNQME_GuBAB3CjHE

Intelligence

File Origin

# of uploads :

# of downloads :

439

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	752'833'984 bytes
SHA256 hash:	21c40ac93892e1e5e136718c251f3410241ff64423d358d32417376b613bc7f2
MD5 hash:	eda391da55d811d8c06dfd01cf5c5507
De-pumped file size:	22'384'640 bytes (Vs. original size of 752'833'984 bytes)
De-pumped SHA256 hash:	8aecd82f1657ec863032e6b326d0c91a7599200a0ef9ba4bfe88a9da5256de8c
De-pumped MD5 hash:	1a2d0fd61c88e6418f984f78884662e6
MIME type:	application/x-dosexec
Signature	Amadey

Vendor Threat Intelligence

Detection(s):

PUA.Win.Packer.AvpAntiviralDat-1

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6810c064c8b2e86d0ac45cd7

Tags:

phishing

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/9024874d28bb97920f3ec5edad7e5e3f1fb9184fb38176abfa167fa7a2cb42f9/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

action bloated entropy expired-cert fingerprint genheur invalid-signature keylogger large-file lolbin microsoft_visual_cc overlay overlay packed rat rat regedit signed

Link:

https://www.filescan.io/uploads/6810baec218c4a98ade739f5/reports/3cfde351-7285-4231-9a8a-eb42f9e46622/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/9024874d28bb97920f3ec5edad7e5e3f1fb9184fb38176abfa167fa7a2cb42f9

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/9024874d28bb97920f3ec5edad7e5e3f1fb9184fb38176abfa167fa7a2cb42f9

Score:

Verdict:

Benign

File Type:

Result

Malware family:

lumma

Score:

10/10

Tags:

family:amadey family:lumma botnet:200131 discovery persistence spyware stealer trojan

Link:

https://tria.ge/reports/250429-n5t5tsysb1/

Behaviour

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Amadey

Amadey family

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://techcastlev.live/kghk
https://805longitudde.digital/wizu
https://hemispherexz.top/xapp
https://equatorf.run/reiq
https://latitudert.live/teui
https://longitudde.digital/wizu
https://climatologfy.top/kbud
http://tackleoutplayed.com

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9024874d28bb97920f3ec5edad7e5e3f1fb9184fb38176abfa167fa7a2cb42f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Bolonyokte Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	UnknownDotNet RAT - Bolonyokte

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Glasses Create hunting rule
Author:	Seth Hardy
Description:	Glasses family

Rule name:	GlassesCode Create hunting rule
Author:	Seth Hardy
Description:	Glasses code features

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)