MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d
SHA3-384 hash: bea5a0b2bcc6b9a255ab8b908b7156b79a7357e68798a03aca22c8c85e7292783bc465a872789181b75b875170066c18
SHA1 hash: 1d801210de170889a6ae1cd62c9d04ac2dbed4be
MD5 hash: 6f148034324ea4c4270ee7f60a7b49a5
humanhash: golf-burger-monkey-pasta
File name:uploaded_exe_c9518f2e116043edb5c9ef46152f2dd8_gtkadktkh.exe
Download: download sample
File size:3'705'344 bytes
First seen:2025-05-21 18:35:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 54188744683a759656c75a1ab471493b
ssdeep 49152:/nCx/oqg8UH6uJZhdb1rQmMep99Lg/GWpeh80RJQQ5VQqMT7et4zL/3lzhUpxSdB:/CLuJyMZb8/eO
TLSH T17C060A67D26D16A6D3E6C2BCF1062766ED3E314836B572B315A243813730B28AF6C357
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter aachum
Tags:exe flare-299-shop


Avatar
iamaachum
http://79.137.204.48:5002/uploaded_exe_c9518f2e116043edb5c9ef46152f2dd8_gtkadktkh.exe

C2: http://flare-299.shop/c

Intelligence

File Origin
# of uploads :
1
# of downloads :
541
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-05-21 18:28:41 UTC
Tags:
lumma stealer themida loader amadey botnet rdp exfiltration purelogs purecrypter telegram auto-sch evasion miner auto gcleaner
Link:
https://app.any.run/tasks/70150bb2-c764-4ca4-8638-65227a7c1be2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Lazy.607683.5770.7459.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682e1e73c28c67d66643ba1a
Tags:
ransomware kryptik virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Connection attempt
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed packed packer_detected
Link:
https://www.filescan.io/uploads/682e1d23fd02ed5e0580c82b/reports/85227685-e0df-4162-8c69-6573d8369766/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1b728f82-0462-47bf-8991-46fc34428db5
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1696213
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-05-21 18:36:33 UTC
File Type:
PE+ (Exe)
AV detection:
20 of 24 (83.33%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=to4ev4yiow3ajzbyk3hezznuiwjsu5wytb73dudblm4x37pylogq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250521-w812jsgj51/
Unpacked files
SH256 hash:
9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d
MD5 hash:
6f148034324ea4c4270ee7f60a7b49a5
SHA1 hash:
1d801210de170889a6ae1cd62c9d04ac2dbed4be
Link:
https://www.unpac.me/results/cf1b8288-371f-4e5c-a109-bd5408c9d7cb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9bb84af30875/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 9bb84af30875b604e43856ce4ce5b445932a76d8987fb1d0615b397dfdf85b8d

(this sample)

  
Link
https://tria.ge/250521-wgrzkazmx8/behavioral1
  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3549545/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetCommandLineW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegDeleteKeyExA
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegQueryValueA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput

Comments