MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 16

Intelligence 16 IOCs YARA File information Comments 1

SHA256 hash:	d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1
SHA3-384 hash:	02e307dee47d0084b265379b53711b5a53338ba47ab6bc9697c13322c1eb575f87a4e108dfe2afecbb245fd4d0f7a31b
SHA1 hash:	0a17fb70b32dbb6babae914f9fb32f166a893009
MD5 hash:	a6edae34668f9c340f9d6bbcc5ea0974
humanhash:	oxygen-lemon-colorado-golf
File name:	a6edae34668f9c340f9d6bbcc5ea0974
Download:	download sample
Signature	Amadey Create hunting rule
File size:	1'940'480 bytes
First seen:	2024-02-14 17:46:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:Y3DHpZlnLXex7KAUsoMm7AnmJhtvRGJcn8HEBXr:2ZlnbeAAUdnEmJxGJ0b
TLSH	T1FB9533297EF20520C4065B3D99878E6DA6F1CD1290A52EBC6F06935B2DBF7484F478AC
TrID	29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	zbetcheckin
Tags:	32 Amadey exe

Intelligence

File Origin

# of uploads :

# of downloads :

343

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1.exe

Verdict:

Malicious activity

Analysis date:

2024-02-14 17:47:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cd3a12df-7d96-4f50-a2d6-976d36244c7f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/476224/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Searching for the window

Creating a file

Creating a window

Searching for synchronization primitives

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a file in the %AppData% subdirectories

Launching a process

Creating a process with a hidden window

Reading critical registry keys

Launching the process to change network settings

Possible injection to a system process

Connection attempt to an infection source

Stealing user critical data

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/65ccfc9e02d5be924b64ec8b/reports/800e864c-3efc-4152-80bd-bbe0818a12f2/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d65fa331-d2fc-40ad-8669-cc096e6d8d61

Result

Threat name:

Amadey

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1392358

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: Capture Wi-Fi password

Sigma detected: Suspicious Script Execution From Temp Folder

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal WLAN passwords

Tries to steal Instant Messenger accounts or passwords

Uses netsh to modify the Windows network and firewall settings

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2024-02-14 17:47:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2u73rpwczrztxtsah3vi2gdh35g34yhuezho7sqahv2yvn2futaq._file

Verdict:

malicious

Result

Malware family:

zgrat

Score:

10/10

Tags:

family:amadey family:glupteba family:redline family:rhadamanthys family:risepro family:smokeloader family:xmrig family:zgrat botnet:@logscloudyt_bot botnet:livetraffic backdoor discovery dropper evasion infostealer loader miner persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/240214-wcv6eshb9s/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Launches sc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Modifies file permissions

Reads local data of messenger clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Creates new service(s)

Downloads MZ/PE file

Modifies Windows Firewall

Stops running service(s)

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner payload

Amadey

Detect ZGRat V1

Glupteba

Glupteba payload

RedLine

RedLine payload

Rhadamanthys

RisePro

SmokeLoader

Suspicious use of NtCreateUserProcessOtherParentProcess

ZGRat

xmrig

Malware Config

C2 Extraction:

http://185.215.113.32
http://193.233.132.167
193.233.132.62
20.79.30.95:33223
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
185.172.128.33:8924