MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 15

Intelligence 15 IOCs YARA 17 File information Comments

SHA256 hash:	9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235
SHA3-384 hash:	8934c2c0f743bc57def05b773c0b98279f312b82fa4d345c087772be19732c3ef0a0c29011b50416bcc89acc38570fff
SHA1 hash:	08583b12ccd93d29a9a450e1ba3e2593151cb1bd
MD5 hash:	49f4e428134b3d6e27c5435f15b8bf1a
humanhash:	nine-princess-red-one
File name:	ama.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	6'496'520 bytes
First seen:	2024-01-11 05:35:06 UTC
Last seen:	2024-01-11 07:14:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	98304:XMCRl9Z0Y8phXgzat8yE8ckgtFUlULehDn0mG:XNxZO7gz48ypWF3X
Threatray	70 similar samples on MalwareBazaar
TLSH	T12C667D06FFA5CE13C1186B37C5E6541843B5E9826763EB0B37D6236919033BF4D8A68B
TrID	42.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 33.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 6.1% (.EXE) Win64 Executable (generic) (10523/12/4) 3.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.FON) Windows Font (5545/9/1)
dhash icon	f0f0f8e0e0c8c8f8 (1 x Amadey)
Reporter	adm1n_usa32
Tags:	Amadey exe

Intelligence

File Origin

# of uploads :

# of downloads :

332

Origin country :

Vendor Threat Intelligence

Detection:

zgRAT

Link:

https://www.capesandbox.com/analysis/470300/

Detection(s):

SecuriteInfo.com.Trojan.Inject5.853.30846.26615.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %temp% directory

Launching a process

Connecting to a non-recommended domain

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Creating a file

Forced shutdown of a system process

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cmd control lolbin macros-on-open nymaim overlay packed regsvcs

Link:

https://www.filescan.io/uploads/659f7e468369fab94dea56ed/reports/2ff42f2d-8034-472a-befe-6dd55a112052/overview

Verdict:

Malicious

Labled as:

Generik.KHZKZWR potentially unwanted application

Link:

https://www.hybrid-analysis.com/sample/9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ddf87c9e-aaee-4121-b762-67647f1be401

Result

Threat name:

Amadey, zgRAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1372858

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235/

Threat name:

ByteCode-MSIL.Trojan.RedLine

Status:

Malicious

First seen:

2024-01-11 03:38:44 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ttm7jyuqgzit7cjkq2337fw7276jqfobfsrd5oa4uc2mnetpui2q._file

Verdict:

malicious

Amadey

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

Amadey

43d7e7f51f3ee88c66a2d6062d82d444c04978b3323c5caf5424585be9c0294c

Amadey

5f2bd04f08f1d65836027822cd62d6de03f12be94e89c7cc3c40fbbab44191f2

Amadey

bca1b830105b7ffeae00fea5f3a993586d0b85e9e3ef21db6c71757f2ad32dab

Amadey

fe6064e70c302549004b15d0f89c94776ab0e1ce0c8b6be604e52f4d7beac73d

Amadey

+ 60 additional samples on MalwareBazaar

Result

Malware family:

zgrat

Score:

10/10

Tags:

family:amadey family:zgrat rat trojan

Link:

https://tria.ge/reports/240111-gakjksgcg8/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

.NET Reactor proctector

Drops startup file

Loads dropped DLL

Amadey

Detect ZGRat V1

ZGRat

Malware Config

C2 Extraction:

http://185.172.128.63

Unpacked files

SH256 hash:

63366bb58836a4d9fc6a7fb5632ce6aeb52fd2ec57ea5d766b27bfedf7b7deee

MD5 hash:

a6810a5899b5a89ee483c9e94dacb015

SHA1 hash:

c787d081f7534936636b17d94ecee651fd64fdac

Link:

https://www.unpac.me/results/8c120d0d-04fe-4eac-9845-cea6ae4c9a56/

SH256 hash:

f9e8d8db3587439a04a9a0e69c938bddb0152004e53e34cad40982d7c680c827

MD5 hash:

57aa9a7fe67cc0641eaf38d4da7177a0

SHA1 hash:

b2cb2fe6c0233278b6321748dc3816b572bc5857

Link:

https://www.unpac.me/results/8c120d0d-04fe-4eac-9845-cea6ae4c9a56/

SH256 hash:

6a26df7ee49de6fec6c5de1f3f7a94075d2dfbc50922e3b30fd8111f2e734f33

MD5 hash:

f45c1512d5a47375e6e396b4d1111e58

SHA1 hash:

8af036b8c60d10e85cf82212930bb04bc0553f36

Link:

https://www.unpac.me/results/8c120d0d-04fe-4eac-9845-cea6ae4c9a56/

SH256 hash:

b4051a9a4a5cf3171c5833aa6e1666826e1f678089546a3d8f7d5fc6720d166f

MD5 hash:

28653e389a649c5c49c9993d16b6b49d

SHA1 hash:

484008fa754ef4e340a7f2047764b962f1f7e004

Detections:

win_amadey_auto

win_amadey

Link:

https://www.unpac.me/results/8c120d0d-04fe-4eac-9845-cea6ae4c9a56/

Parent samples :

9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235
29d426c1e5a22c269422780d83e061f23b71e65264cee388ad4f27f7eddbdf2c
578a26ad82bcc107d241234a1c7d89b226501edc3b082d589bc6c115a62588cb
22eb695c324270e56f16f129142a77f0ef297eb657eca436c85733aca7eb24d9
114db178958c732f5328b2227802850b3eea3c16708b10ea2afe8b2a58bf0949
37be0861185e25e87d406031c55583d99260be44b6fe929a912aca4573d5ac5a
5d905533d8e256b512b055c2cd67ea481307b83a9c4e10cb5ae1999eafb36586
1a5c7660734a21cca0291598a5f887bb54d0708ec7335ec9f7602b796e021773
ac44abe03d661612ce75f13b519cadfb4c9a739ebcecb707a54bbd575a887a2a
784468b404f0132cf74488744453d6ad499c5cbf618c526796f606c1a7edd3c8
49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20
8091a01aee616d356336705e45ef94f346682a6a77ffaa29bbe433364f2ee54e
cb80f3f8dbdf12c6929acd19d547b1c0278e7b71a4e2bcf232a7776cf1c287df
ec78f97f5dee77537df9ef30f8d899da9f76ddbbb1aeee9fc7194bd7da631f7b
dd6a120bfbd75b5db0800585471e7ec52913d4fda536182f253eac5198a67440
36a30e606017f573e19072778619ee90c3f20a58d3a428beca5d5da742936e28
e74eb577ebba368cbfa8b8142037eb080ba6e8dee520e99be8cb8cb41072f4aa
b4051a9a4a5cf3171c5833aa6e1666826e1f678089546a3d8f7d5fc6720d166f

SH256 hash:

dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

MD5 hash:

544cd51a596619b78e9b54b70088307d

SHA1 hash:

4769ddd2dbc1dc44b758964ed0bd231b85880b65

Link:

https://www.unpac.me/results/8c120d0d-04fe-4eac-9845-cea6ae4c9a56/

SH256 hash:

9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235

MD5 hash:

49f4e428134b3d6e27c5435f15b8bf1a

SHA1 hash:

08583b12ccd93d29a9a450e1ba3e2593151cb1bd

Detections:

INDICATOR_EXE_Packed_DotNetReactor

MALWARE_Win_zgRAT

Link:

https://www.unpac.me/results/8c120d0d-04fe-4eac-9845-cea6ae4c9a56/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9cd9f4e29036/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.69

Link:

https://yomi.yoroi.company/submissions/9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Amadey Create hunting rule
Author:	kevoreilly
Description:	Amadey Payload

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_DotNetReactor Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with unregistered version of .NET Reactor

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_zgRAT Create hunting rule
Author:	ditekSHen
Description:	Detects zgRAT

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	win_amadey_a9f4 Create hunting rule
Author:	Johannes Bader
Description:	matches unpacked Amadey samples

Rule name:	win_amadey_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.amadey.

Rule name:	win_amadey_bytecodes_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

exe 9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2733669/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2737075/

URLhaus

https://urlhaus.abuse.ch/url/2744395/

URLhaus

https://urlhaus.abuse.ch/url/2739361/

Cape

https://www.capesandbox.com/analysis/470300/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample