MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
SHA3-384 hash: e252b211d528e5f17d19ca0dada58795c4a232f5e282b2591e92a9aced11cfbd50044dc006970fe6c09607af64c07b43
SHA1 hash: 2682a13d58b90bbeeb722e5494924f86d083ff90
MD5 hash: de602f032c362bdc1440d7a92874cd6f
humanhash: massachusetts-twelve-music-mars
File name:OOO Tochka
Download: download sample
Signature Amadey
Create hunting rule
File size:203'760 bytes
First seen:2021-02-17 09:03:56 UTC
Last seen:2021-02-17 10:55:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 478a2dde8c3f83e38bff75abb2fb16e2 (1 x RedLineStealer, 1 x Amadey)
ssdeep 3072:uGx+4oMmxWQBn5k7LOWqpprbkhrebkAJJe2PBp5Rfk2:u6+pTk73QFSrqkANPBZT
Threatray 18 similar samples on MalwareBazaar
TLSH 4D14D0217A90C073CA47453418FDC2F26A3AF8629BB182C7F795673E2F613E15739219
Reporter JAMESWT_WT
Tags:Amadey OOO Tochka signed

Code Signing Certificate

Organisation:OOO Tochka
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-11-06T00:00:00Z
Valid to:2021-11-06T23:59:59Z
Serial number: ac0a7b9420b369af3ddb748385b981
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: fd4ca717b1e19a1ff27d2b3e61e419113f7d6ffae04829a8534f7b1c6fca2be8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
508
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/117536/
Detection(s):
SecuriteInfo.com.Trojan.SpyBot.1047.835.21976.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Launching a process
Sending a UDP request
Reading critical registry keys
Connection attempt
Creating a file in the %temp% directory
Deleting a recently created file
Connection attempt to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/609995
Signature
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Amadey bot
Yara detected Amadey\'s stealer DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 354019 Sample: OOO Tochka Startdate: 17/02/2021 Architecture: WINDOWS Score: 100 55 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->55 57 Antivirus detection for dropped file 2->57 59 Multi AV Scanner detection for dropped file 2->59 61 7 other signatures 2->61 8 OOO Tochka.exe 4 2->8         started        process3 file4 29 C:\ProgramData\80373760c0\rween.exe, PE32 8->29 dropped 11 rween.exe 20 8->11         started        process5 dnsIp6 43 185.215.113.17, 49704, 49705, 49706 WHOLESALECONNECTIONSNL Portugal 11->43 31 C:\Users\user\AppData\Local\...\scr[1].dll, PE32 11->31 dropped 33 C:\Users\user\AppData\Local\...\cred[1].dll, PE32 11->33 dropped 35 C:\ProgramData\0141f24c463d89\scr.dll, PE32 11->35 dropped 37 C:\ProgramData\0141f24c463d89\cred.dll, PE32 11->37 dropped 65 Multi AV Scanner detection for dropped file 11->65 67 Detected unpacking (changes PE section rights) 11->67 69 Machine Learning detection for dropped file 11->69 16 rundll32.exe 11->16         started        20 cmd.exe 1 11->20         started        22 rundll32.exe 1 11->22         started        file7 signatures8 process9 dnsIp10 39 192.168.2.5, 443, 49674, 49675 unknown unknown 16->39 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->45 47 Tries to steal Instant Messenger accounts or passwords 16->47 49 Tries to steal Mail credentials (via file access) 16->49 51 Tries to harvest and steal ftp login credentials 16->51 24 reg.exe 1 20->24         started        27 conhost.exe 20->27         started        41 192.168.2.1 unknown unknown 22->41 53 System process connects to network (likely due to code injection or exploit) 22->53 signatures11 process12 signatures13 63 Creates an undocumented autostart registry key 24->63
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 07:25:24 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwhw2wl4rdtzxm2o453ce67cgujbw6qpnomrod7vp73gvfvjidwq._file
Verdict:
suspicious
Similar samples:
035a62c9a13176755bbe5ea0d9c8a609c9f237a6e0af811abb934ca8654eb753
Amadey
100f3322fa66d60cb9a64e2cbcceb0a9558e65e600526fcbc25852d62940c7ea
Amadey
320a5f1b26e4b73c4bde7e447f2505459b6e9c2b70c432a68bbabd84b46ca988
Amadey
53237c2782ec5dbdabb8350a3ef5e8c25662436052e92ae1300f3f41be984ea6
Amadey
8245be0ad940e016ae3607777c0c9f7076c03685c1d4729601382bfc80008e0a
Amadey
8f60cc67e1745eba443fb74537796f29095b9d71885a2232274ba5d96888d0f0
Amadey
c10df7ff1234d45342b534153be81de8f252e88ae00413bdd476ddfc05d542e9
Amadey
cea813cbef6581e0c95aacb2e747f5951325444b941e801164154917a17bfe71
Amadey
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
Amadey
f327fd0a9151dfcbdfadd244a57d3cdb08e55f5ec3ced39497a39c2ff01d95ce
Amadey
+ 8 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey trojan
Link:
https://tria.ge/reports/210217-xbsbsbsyks/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
Amadey
Unpacked files
SH256 hash:
635f31e3ee5a19df5f6499f259b07c68b60b264831e378e8413fb296535cd120
MD5 hash:
d5eee35a6516d124090ba442d94cc3ae
SHA1 hash:
b4a76a68d1b0b4cc8b9058f3c4a3c6d3505acba2
Link:
https://www.unpac.me/results/403f4cef-8428-4e93-a644-dc0549960239/
SH256 hash:
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
MD5 hash:
de602f032c362bdc1440d7a92874cd6f
SHA1 hash:
2682a13d58b90bbeeb722e5494924f86d083ff90
Link:
https://www.unpac.me/results/403f4cef-8428-4e93-a644-dc0549960239/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/117536/

Comments