MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4fc3473070e7f587dbfec7574d0ca62765d002cce206903a5762e68ef736945. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4fc3473070e7f587dbfec7574d0ca62765d002cce206903a5762e68ef736945
SHA3-384 hash: b867ce3aa30fef470916ec06ded1659a8ba3988140609421a3058ada19a259653c84164793fa9c2af9b9b4417c86d781
SHA1 hash: 50606ffe5b57d12d1f73db8a32a0aad17bcacf9b
MD5 hash: 7c67d851dbecde6ded6be9e9a278be96
humanhash: delaware-grey-march-charlie
File name:7C67D851DBECDE6DED6BE9E9A278BE96.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:196'096 bytes
First seen:2021-03-28 21:25:37 UTC
Last seen:2021-03-28 21:48:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 303731902794af44505b2d0a758a7088 (2 x Amadey)
ssdeep 3072:YN1NOJTvUh5HQNIS/WzWekTJHrvNeQPDnTz3e97yumqMVs2ppif7H:21NkTi6NWzDkT1rwGD3ecumqjj
Threatray 26 similar samples on MalwareBazaar
TLSH EB1428653856C032D561657119F5BFF6C6ADAC04ABB049DF2B800F76DA222F37930E3A
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://xtkehjjerbk.icu/j7csltegf/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://xtkehjjerbk.icu/j7csltegf/index.php https://threatfox.abuse.ch/ioc/5648/

Intelligence

File Origin
# of uploads :
2
# of downloads :
444
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7C67D851DBECDE6DED6BE9E9A278BE96.exe
Verdict:
Malicious activity
Analysis date:
2021-03-28 21:31:16 UTC
Tags:
trojan amadey loader phishing stealer
Link:
https://app.any.run/tasks/422126de-7870-466b-856c-1e4aba74d84b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Amadey
Create hunting rule
Link:
https://www.capesandbox.com/analysis/127397/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader38.9628.30798.32417.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Launching a process
DNS request
Reading critical registry keys
Sending a UDP request
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8fb43a1f-d360-4e9c-9e98-9d8cec632571
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/656259
Signature
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Amadey bot
Yara detected Amadeys stealer DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 377062 Sample: Yyl2t5SLA3.exe Startdate: 28/03/2021 Architecture: WINDOWS Score: 100 46 por3m0ngl45.icu 2->46 48 mor3m0ngl45.icucu 2->48 50 2 other IPs or domains 2->50 70 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->70 72 Antivirus detection for dropped file 2->72 74 Multi AV Scanner detection for dropped file 2->74 76 5 other signatures 2->76 9 Yyl2t5SLA3.exe 4 2->9         started        signatures3 process4 file5 36 C:\ProgramData\07fc519c6f\bkdm.exe, PE32 9->36 dropped 86 Contains functionality to inject code into remote processes 9->86 13 bkdm.exe 20 9->13         started        signatures6 process7 dnsIp8 64 mor3m0ngl45.icu 13->64 66 xtkehjjerbk.icu 213.227.154.192, 49720, 49721, 49722 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 13->66 68 3 other IPs or domains 13->68 38 C:\Users\user\AppData\Local\...\scr[1].dll, PE32 13->38 dropped 40 C:\Users\user\AppData\Local\...\cred[1].dll, PE32 13->40 dropped 42 C:\ProgramData\9b026d4b11eb57\scr.dll, PE32 13->42 dropped 44 C:\ProgramData\9b026d4b11eb57\cred.dll, PE32 13->44 dropped 88 Multi AV Scanner detection for dropped file 13->88 90 Machine Learning detection for dropped file 13->90 18 rundll32.exe 13->18         started        22 rundll32.exe 1 13->22         started        24 cmd.exe 1 13->24         started        26 4 other processes 13->26 file9 92 System process connects to network (likely due to code injection or exploit) 64->92 signatures10 process11 dnsIp12 52 xtkehjjerbk.icu 18->52 54 mor3m0ngl45.icu 18->54 56 1mr34llys0rry.icu 18->56 78 System process connects to network (likely due to code injection or exploit) 18->78 80 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->80 82 Tries to steal Instant Messenger accounts or passwords 18->82 84 2 other signatures 18->84 58 xtkehjjerbk.icu 22->58 60 mor3m0ngl45.icu 22->60 28 WerFault.exe 23 9 22->28         started        31 reg.exe 1 24->31         started        34 conhost.exe 24->34         started        signatures13 process14 dnsIp15 62 mor3m0ngl45.icu 28->62 94 Creates an undocumented autostart registry key 31->94 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4fc3473070e7f587dbfec7574d0ca62765d002cce206903a5762e68ef736945/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2021-03-24 11:23:48 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ut6di4yhbz7vq7n75r2xjugkmj3f2abmzyqgsa5foyxgr33tnfcq._file
Verdict:
suspicious
Similar samples:
28a75db0185788d50a739a0e1354d1b84fa4a0cd55527d6103cbef6685147584
Amadey
320a5f1b26e4b73c4bde7e447f2505459b6e9c2b70c432a68bbabd84b46ca988
Amadey
3abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926
Amadey
53237c2782ec5dbdabb8350a3ef5e8c25662436052e92ae1300f3f41be984ea6
Amadey
726a77e9ed33bcd7f0178d49fc6f332410fdff0e88d35b19521b54e81835eff5
Amadey
adf16f6cc8d86339b88db357b9ce7698b8ccecafa0ec6ed4bf301034298bf8a8
Amadey
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
Amadey
c10df7ff1234d45342b534153be81de8f252e88ae00413bdd476ddfc05d542e9
Amadey
d67a9a907a5ca20e610e3e69777ebc80eb61c55e849545e85297046843538ab3
Amadey
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
Amadey
+ 16 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey spyware stealer trojan
Link:
https://tria.ge/reports/210328-zcheylmqnx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Reads local data of messenger clients
Blocklisted process makes network request
Executes dropped EXE
Amadey
Malware Config
C2 Extraction:
xtkehjjerbk.icu/j7csltegf/index.php
mor3m0ngl45.icu/j7csltegf/index.php
1mr34llys0rry.icu/j7csltegf/index.php
Unpacked files
SH256 hash:
a4fc3473070e7f587dbfec7574d0ca62765d002cce206903a5762e68ef736945
MD5 hash:
7c67d851dbecde6ded6be9e9a278be96
SHA1 hash:
50606ffe5b57d12d1f73db8a32a0aad17bcacf9b
Link:
https://www.unpac.me/results/0062843a-1b60-4c37-8192-3850b225d9b7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4fc3473070e7f587dbfec7574d0ca62765d002cce206903a5762e68ef736945

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/127397/

Comments