MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 10


Intelligence 10 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c
SHA3-384 hash: 4f4c5f133582fbbde0339ab30a10ab3d010c89e6ed5ed575ec405c10bce7ed10f496da412052ca2c1a1b36f4e384c49e
SHA1 hash: 89c30e4fbe264df9ff25a2a9f4e60bd32bd03bcc
MD5 hash: 7a939924177e0b931b9fe2f1e2804dfe
humanhash: pluto-enemy-island-lithium
File name:ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c
Download: download sample
Signature Amadey
Create hunting rule
File size:10'765'648 bytes
First seen:2023-09-05 11:07:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7ca2ada15fca9ba51b650e1414510d44 (2 x Amadey, 1 x LummaStealer, 1 x RemcosRAT)
ssdeep 196608:MV0I8onCri+vQRIq0iq2h3oeoYSeyB6vnKCD25kvmeh6vFF//aFcPezl9:ML8on2i+vUIqZHScvKCBtwF+
Threatray 67 similar samples on MalwareBazaar
TLSH T169B6F122BA41C431E4920578586BAB78457DBE208B75C4D3A7D43E6FF9314D32B3A36B
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 30b28a83e3f37a98 (2 x Amadey)
Reporter adrian__luca
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
290
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://productkeyforfree.com
Verdict:
Malicious activity
Analysis date:
2023-08-24 11:37:27 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/4377fd10-dbc0-49d6-87e4-943b80727cf4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/446298/
Detection(s):
SecuriteInfo.com.W32.TrojanSpy_Win32_LUMMASTEALER.YXDHXZ.24633.13687.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
83%
Tags:
anti-debug control expand greyware keylogger lolbin overlay packed remote shell32
Link:
https://www.filescan.io/uploads/64f70c132a262962b793b224/reports/bf95527c-845a-47ea-939a-76ce81519e7e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c798cc87-ac9a-431a-bbff-fbedb6043d55
Result
Threat name:
LummaC Stealer, MicroClip
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1303455
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected LummaC Stealer
Yara detected MicroClip
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1303455 Sample: 8qCeXG3Ag5.exe Startdate: 05/09/2023 Architecture: WINDOWS Score: 100 70 Snort IDS alert for network traffic 2->70 72 Antivirus detection for URL or domain 2->72 74 Antivirus detection for dropped file 2->74 76 6 other signatures 2->76 12 8qCeXG3Ag5.exe 1 2->12         started        16 LEAJ.exe 2->16         started        process3 dnsIp4 66 www.arthritis.org 104.22.10.53, 443, 49723 CLOUDFLARENETUS United States 12->66 68 arthritis.org 172.67.28.160, 443, 49722 CLOUDFLARENETUS United States 12->68 102 Maps a DLL or memory area into another process 12->102 18 cmd.exe 2 12->18         started        104 Query firmware table information (likely to detect VMs) 16->104 106 Hides threads from debuggers 16->106 108 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->108 signatures5 process6 file7 54 C:\Users\user\AppData\Local\Temp\tgk, PE32 18->54 dropped 78 Injects code into the Windows Explorer (explorer.exe) 18->78 80 Writes to foreign memory regions 18->80 82 Found hidden mapped module (file has been removed from disk) 18->82 84 Maps a DLL or memory area into another process 18->84 22 explorer.exe 13 18->22         started        27 conhost.exe 18->27         started        signatures8 process9 dnsIp10 60 104.21.38.44, 49781, 49782, 49785 CLOUDFLARENETUS United States 22->60 62 marrakechfolkloredays.com 104.21.83.63, 443, 49811, 49812 CLOUDFLARENETUS United States 22->62 64 kudoflowers.xyz 172.67.218.233, 49777, 49778, 49779 CLOUDFLARENETUS United States 22->64 56 C:\Users\user\...\vqulwwersqsxnitjmih.exe, MS-DOS 22->56 dropped 86 System process connects to network (likely due to code injection or exploit) 22->86 88 Query firmware table information (likely to detect VMs) 22->88 90 Performs DNS queries to domains with low reputation 22->90 92 2 other signatures 22->92 29 vqulwwersqsxnitjmih.exe 4 22->29         started        33 cmd.exe 1 22->33         started        file11 signatures12 process13 file14 58 C:\ProgramData\presepuesto\LEAJ.exe, MS-DOS 29->58 dropped 110 Antivirus detection for dropped file 29->110 112 Multi AV Scanner detection for dropped file 29->112 114 Detected unpacking (changes PE section rights) 29->114 116 3 other signatures 29->116 35 cmd.exe 1 29->35         started        37 conhost.exe 33->37         started        39 timeout.exe 1 33->39         started        41 fsutil.exe 1 33->41         started        signatures15 process16 process17 43 LEAJ.exe 3 35->43         started        46 conhost.exe 35->46         started        48 timeout.exe 1 35->48         started        signatures18 94 Antivirus detection for dropped file 43->94 96 Multi AV Scanner detection for dropped file 43->96 98 Detected unpacking (changes PE section rights) 43->98 100 5 other signatures 43->100 50 schtasks.exe 1 43->50         started        process19 process20 52 conhost.exe 50->52         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2023-08-24 11:37:29 UTC
File Type:
PE (Exe)
Extracted files:
901
AV detection:
13 of 24 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vu2pwlihym2a4frbr2dlmy7mhfyx37rq7ckrxu4seyb25242t6ga._file
Verdict:
malicious
Similar samples:
199de8b727ceae96afb7c7560092c1d7a4dbe5a005c07ae20cffd9871da52b82
Amadey
1b09e1ef7e44680e2fdd5909dbae73c46ad9d4d007f9ef077acfa102a613f908
Amadey
3131f31a4b39b30cc4498c17115c2d24dc588835c9d609076058772d4a96a217
Amadey
428280c60495d98bb323401c877783e641d21f649684fbacbb29bc8067bf6635
Amadey
49f412c22d9944bbc1948cd41574d0856a12a7884600298ce129d1ffed5bf6dc
Amadey
53ede26e1b5b7287a78002c268363493d9aa8b35ab2cdb571444adcd7a4752ce
Amadey
958085c479df4ae7ebbd407dd43f11edcb0fa4677470c819fcaf5df87191b992
Amadey
cc1d1ef82f7887443e7902e8e91013f3308804f7143ef769e0b3e98a45aee037
Amadey
e5447818976ad7af2ae55ccee4baab64d2a76ce8bcd43654ca8361dc19c91ad4
Amadey
+ 57 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230905-m8jylaeh8t/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
4e3da75745b7e4887965862b11ba68bc7aadf3ea000636554dfc8f0b8e3261ae
MD5 hash:
7be4a95313c926e0233571f89291f487
SHA1 hash:
a16e410af1f001434d5ed5194f0755aa24173589
Link:
https://www.unpac.me/results/c9e4c7e0-a5f9-447f-8330-158adc017f8c/
SH256 hash:
ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c
MD5 hash:
7a939924177e0b931b9fe2f1e2804dfe
SHA1 hash:
89c30e4fbe264df9ff25a2a9f4e60bd32bd03bcc
Link:
https://www.unpac.me/results/c9e4c7e0-a5f9-447f-8330-158adc017f8c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Sandworm_ArguePatch_Apr_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang
Create hunting rule
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/446298/

Comments