MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61
SHA3-384 hash: 0d190bbe7abdd84abe9353a746a0e99ccabf1e21c9036ff09fd01d6dc2d22b760a5ea3521ca6f8d8d811ffa0defc251f
SHA1 hash: 3f3e91f7b65be4e4b24fd29ea837206c00d55fc3
MD5 hash: 5aa3b4d694bc828650c63ade641f4581
humanhash: north-magazine-sierra-nitrogen
File name:SecuriteInfo.com.Win32.TrojanX-gen.22664.27275
Download: download sample
Signature Amadey
Create hunting rule
File size:1'920'000 bytes
First seen:2024-07-26 11:52:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 24576:bcW1jg/Z+bPaeDOAIsfkRTePAFt2adNSUZBNMxsMFAbwfSQbcI+LWBMmQ4JX+ZGm:gmjglbsfkRmadNbqBFA9HCW4wF5uCb
TLSH T1F59533B31C5708ACEA576372D157C1D0E5A72427C73AE2B6012E9D39BD93CB1EB028D6
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter SecuriteInfoCom
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
345
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a38dfa458e130e002a9ecf
Tags:
Infostealer Network Stealth Trojan Crypt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Creating a file
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66a38de88f66298c01f3dc36/reports/486f54ca-dd4e-40b9-8983-69e3a1cdc6c5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/396be4ee-02b7-462d-a03b-2d43f3212b04
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1483011
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected Amadeys stealer DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1483011 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 22 Found malware configuration 2->22 24 Antivirus detection for URL or domain 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 5 other signatures 2->28 6 SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.exe 5 2->6         started        10 explorti.exe 2->10         started        process3 file4 16 C:\Users\user\AppData\Local\...\explorti.exe, PE32 6->16 dropped 18 C:\Users\...\explorti.exe:Zone.Identifier, ASCII 6->18 dropped 30 Detected unpacking (changes PE section rights) 6->30 32 Tries to evade debugger and weak emulator (self modifying code) 6->32 34 Tries to detect virtualization through RDTSC time measurements 6->34 36 Potentially malicious time measurement code found 6->36 12 explorti.exe 12 6->12         started        38 Hides threads from debuggers 10->38 40 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->40 42 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 10->42 signatures5 process6 dnsIp7 20 185.215.113.19, 49704, 49705, 49706 WHOLESALECONNECTIONSNL Portugal 12->20 44 Antivirus detection for dropped file 12->44 46 Detected unpacking (changes PE section rights) 12->46 48 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->48 50 6 other signatures 12->50 signatures8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61/
Threat name:
Win32.Spyware.Stealc
Create hunting rule
Status:
Suspicious
First seen:
2024-07-26 11:50:45 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 24 (87.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2omd4uwerjxzqrfvziicjdxfdofb6k6wmnzeh7ydqsusfccxf5qq._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:stealc botnet:0657d1 botnet:sila discovery evasion persistence stealer trojan
Link:
https://tria.ge/reports/240726-n1qa3swbnq/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Stealc
Malware Config
C2 Extraction:
http://185.215.113.19
http://85.28.47.31
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b6884e27-59be-4944-b70e-e880d5a10fa8
Unpacked files
SH256 hash:
441595c45aaaacf1e687143fdb76dda98d4ec84a3b9e7004b709bc177c965713
MD5 hash:
567dc7c790e36c1c332c86cf9f956b7f
SHA1 hash:
4a3e79fab306174f655bcd6fc67b2fb0ab0aed19
Detections:
win_amadey
Create hunting rule
Link:
https://www.unpac.me/results/8f8d027c-097c-43c7-bab9-ce289a5fd58e/
SH256 hash:
d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61
MD5 hash:
5aa3b4d694bc828650c63ade641f4581
SHA1 hash:
3f3e91f7b65be4e4b24fd29ea837206c00d55fc3
Link:
https://www.unpac.me/results/8f8d027c-097c-43c7-bab9-ce289a5fd58e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d3983e52c48a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe d3983e52c48a6f9844b5ca10248ee51b8a1f2bd6637243ff0384a92288572f61

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3068170/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments