MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amatera


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec
SHA3-384 hash: 7ae29f423f06171dc0f10b9dab92f81832653e2cad2488274ce55ed3cd2930678b55c849e95eb60286b1085ac20b3ba1
SHA1 hash: 45885cce8115d594dc09be172f9fafd0993a5ba9
MD5 hash: fa35125ea4d401d91a8b101c94d5ba19
humanhash: south-beer-saturn-summer
File name:mal2.exe
Download: download sample
Signature Amatera
Create hunting rule
File size:7'426'160 bytes
First seen:2025-12-24 12:06:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash eb15b02cf30bfba01db8175d4aa4c176 (1 x Amatera)
ssdeep 196608:4wwyPSk9swJofd2RGRVoVbK8kcd6l5hxhrKo:4wwyP1zJo12k7m28kAw5hDGo
Threatray 1 similar samples on MalwareBazaar
TLSH T1EE760232B603D57AE56202B1987C670A921CBF6007738ADBA3CC7A3D4E755C22F71E56
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Ling
Tags:Amatera exe Sonbokli Trojan:Win32/Sonbokli.A!cl


Avatar
Ling
This sample has been reviewed by Microsoft researchers and determined to be malware. (Trojan:Win32/Sonbokli.A!cl)

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
mal2.exe
Verdict:
Malicious activity
Analysis date:
2025-12-24 10:11:55 UTC
Tags:
stealer amatera exploit
Link:
https://app.any.run/tasks/956dd9d9-baca-45f2-9d71-827d32d4a2d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45973/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694bd77401c7b4a8fe5548e2
Tags:
injection phishing obfusc virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 expired-cert fingerprint genheur installer-heuristic invalid-signature microsoft_visual_cc overlay overlay packed packed signed
Link:
https://www.filescan.io/uploads/694bd771e8abb702f8062918/reports/114dd678-5150-454f-9cb4-4baff813035a/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec
Result
Gathering data
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-23T18:17:00Z UTC
Last seen:
2025-12-24T08:11:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/de29433a-6e36-4925-b8d5-1f0c850364b2
Score:
15%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/fa35125ea4d401d91a8b101c94d5ba19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec/
Verdict:
Malicious
Threat:
Trojan.Win32
Link:
https://tip.neiki.dev/file/9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tbtkr3hvifbihwevfbmx5577lehwbzbku36es4xwdiedykyiyhwa._file
Verdict:
malicious
Label(s):
unc_loader_053
Create hunting rule
amaterastealer
Create hunting rule
Similar samples:
9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec
Amatera
error
Amatera
Gathering data
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/569c1d67-cea4-4276-b5db-3f82cb95e5d1
Unpacked files
SH256 hash:
9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec
MD5 hash:
fa35125ea4d401d91a8b101c94d5ba19
SHA1 hash:
45885cce8115d594dc09be172f9fafd0993a5ba9
Link:
https://www.unpac.me/results/eeb9831e-eaba-413c-92c1-31362d7cba7f/
SH256 hash:
2822754c2be2ebf64c5295343e236ec179582a9eca6d4ee30a958fae5914b51f
MD5 hash:
d924c1fb7abe989910a59bbe0ee3e9b2
SHA1 hash:
562384524a466b07f00842d4bf46610b72ea3d40
Link:
https://www.unpac.me/results/eeb9831e-eaba-413c-92c1-31362d7cba7f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9866a8ecf541/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.27
Link:
https://yomi.yoroi.company/submissions/9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Surtr
Create hunting rule
Author:Katie Kleemola
Description:Rule for Surtr Stage One
Rule name:SurtrStrings
Create hunting rule
Author:Katie Kleemola
Description:Strings for Surtr

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amatera

Executable exe 9866a8ecf5414283d89528597ef7ff590f60e42aa6fc4972f61a083c2b08c1ec

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/45973/

Comments