🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 5


Intelligence 5 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b
SHA3-384 hash: 09496021d321364e267131ee36519e0728a43297bed49a5b9127537852f82602ce352a462e01e9fe474c03e1e96b2306
SHA1 hash: aaeb7d47cb6c7bb28976c0ce565619e453111844
MD5 hash: 0c3f83b455aafd1fa11b4fb436b36393
humanhash: yellow-pasta-one-white
File name:amsht.bin
Download: download sample
Signature Amadey
Create hunting rule
File size:16'212'933 bytes
First seen:2025-04-29 11:32:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:tN+SasNz9M1fjTaX3X11aJOgxSNHq6hkzFdgpW+oXdvi0K671:vVasNz4f0YOgxSxX2FJdvJ
TLSH T156F6336A548F1652FB2F98209D53E1F152E64F3DB83DCC0EFBF06A512921BACA837144
Magika zip
Reporter aachum
Tags:200131 Amadey dropped-by-LummaStealer HIjackLoader IDATLoader zip


Avatar
iamaachum
https://h1.startingshabby.world/amsht.bin

Amadey Botnet: 200131
Amadey C2: http://tackleoutplayed.com/yLC6Ya9ut5bfTA/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
320
Origin country :
ES ES
File Archive Information

This file archive contains 24 file(s), sorted by their relevance:

File name:libssl-1_1-x64.dll
File size:1'019'656 bytes
SHA256 hash: b087d9fa3bca01d853d07e98181fdf171dccccf1cb7fb74e896feb5120c628e7
MD5 hash: 2574e9e3159cd45194eac2591eadc73a
MIME type:application/x-dosexec
Signature Amadey
File name:msvcp120.dll
File size:659'616 bytes
SHA256 hash: 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
MD5 hash: edef53778eaafe476ee523be5c2ab67f
MIME type:application/x-dosexec
Signature Amadey
File name:57
File size:2'560 bytes
SHA256 hash: 7343619b9b145445f12c102aa6c461a0b92c3e078cfb0a825705c06170e14828
MD5 hash: d7322b054d28f3257c0c399711a1b3c2
MIME type:application/octet-stream
Signature Amadey
File name:45
File size:8'192 bytes
SHA256 hash: 5ff266b260ca999b373d1c13cc646f3a50010c4642df3848f920ddbd138c61e2
MD5 hash: 828826f7e720b458e5b1bfddec76bd51
MIME type:application/octet-stream
Signature Amadey
File name:Qt5Widgets.dll
File size:5'539'000 bytes
SHA256 hash: 250c3717663e4ab3ce50e4a53bc532bf0c0850d2917773dd7e482e733081a1a1
MD5 hash: 2bd07acef2ffd5ad8388b714d4f81995
MIME type:application/x-dosexec
Signature Amadey
File name:Qt5Network.dll
File size:1'086'648 bytes
SHA256 hash: 7bfdfed166846921dab87d51ca9b338c1fdd7f96c117e3ba0edc07ed06dd9cb1
MD5 hash: d73aa4f8749269d1590541e567387489
MIME type:application/x-dosexec
Signature Amadey
File name:4
File size:1'024 bytes
SHA256 hash: 90670f1703d585f8476a68708b07ea10cdc11e563536c9d791fed093e67f3574
MD5 hash: 70d3dae51dd50cdf794fa06c8ec0040f
MIME type:application/octet-stream
Signature Amadey
File name:msvcr120.dll
File size:963'240 bytes
SHA256 hash: d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
MD5 hash: aeb29ccc27e16c4fd223a00189b44524
MIME type:application/x-dosexec
Signature Amadey
File name:Lab.cum
File size:67'228 bytes
SHA256 hash: e297951c712d5e5845e7935766b1e975a459e43bc11022a978c1c4241219d0f3
MD5 hash: 7cb269327e0287f8258ab2a1b4735207
MIME type:application/octet-stream
Signature Amadey
File name:81
File size:11'776 bytes
SHA256 hash: 6076bf3022d000c638f4d7f5f2c40a400582e4586cef55350f1897419a2b61f0
MD5 hash: ed946bb1898d3723e4c490fdd32bed80
MIME type:application/octet-stream
Signature Amadey
File name:Qt5Gui.dll
File size:6'024'376 bytes
SHA256 hash: 6b8a49b6b37d69213762c8f2c8a9970014364f4055f08a850d27c0343fbe00de
MD5 hash: 72ac63e9e9f015d6471dde58297a4fc6
MIME type:application/x-dosexec
Signature Amadey
File name:Framework.dll
File size:1'426'616 bytes
SHA256 hash: c554a0bd610ba0b10d8d92bb588fc86893b59985e4ed9316d340781c482fcaa2
MD5 hash: 2207332818329e3ce4e5e020ba1b1f04
MIME type:application/x-dosexec
Signature Amadey
File name:COFF_SYMBOLS
File size:170'058 bytes
SHA256 hash: 3aa18d8e4c312e29014e6e59611b7c113b5ca5397fef2857fac4950c61b0d8e2
MD5 hash: ac430c5a73bf35adc4890f77d2e99c3b
MIME type:application/octet-stream
Signature Amadey
File name:31
File size:8'192 bytes
SHA256 hash: 3a369cf4605c8edbb221456b7ba5bed2decc3fd2aecbc5f1e275aef4c225ef6d
MD5 hash: f35bb498f193f1d0be9654b0d614860a
MIME type:application/octet-stream
Signature Amadey
File name:Utility.dll
File size:25'272 bytes
SHA256 hash: 90cf67bee83e0180a11eec82115e930cb1beda60790cfc17542fcadbec25df11
MD5 hash: 48b0445f21b92190b1e199ad31f89cbc
MIME type:application/x-dosexec
Signature Amadey
File name:Clus-Blue.exe
File size:50'360 bytes
SHA256 hash: 1cc7879c59bdd6c0fb2ce28c89bb4a626396cc1c3801bcede2679da5a6d7d5bc
MD5 hash: 20bc61aa222aa74059f4d42872a76eb5
MIME type:application/x-dosexec
Signature Amadey
File name:70
File size:1'536 bytes
SHA256 hash: b7570a94ec225d8020c39e6ebcae5a1d04122841cc58fe31014fc05551531079
MD5 hash: db0c7268402e15534c6d08db8601d787
MIME type:application/octet-stream
Signature Amadey
File name:libcrypto-1_1-x64.dll
File size:3'660'456 bytes
SHA256 hash: 0897f6ef6c7875f64ed82ad83473fd8ea119cfeaa959b0ab2b2f981c1da7c679
MD5 hash: cf1df078fa02c3f20a613ff9faceee46
MIME type:application/x-dosexec
Signature Amadey
File name:92
File size:1'536 bytes
SHA256 hash: 1de3043931bc31991e6874b18fd5e5073f3babb813741ad9b53054bfe31cd30a
MD5 hash: fbe98bf9f0628816d06215779b50f89f
MIME type:application/octet-stream
Signature Amadey
File name:Kingfrae.srze
File size:1'938'410 bytes
SHA256 hash: f957352080219828dcbc012b60736c624d7340d6ceee97aabb5c505b68f3694b
MD5 hash: fa90a001c2f9bdc09df22b6a8106fea3
MIME type:application/octet-stream
Signature Amadey
File name:Qt5Xml.dll
File size:208'568 bytes
SHA256 hash: 8a70f0c243e7c6ec5f60ec667d20bbc89de53a1455d7cd4313da337760030655
MD5 hash: efee87118a310edb82a7a6aeebaec1c1
MIME type:application/x-dosexec
Signature Amadey
File name:19
File size:247'808 bytes
SHA256 hash: 2f03632f0c7dc5d2d6bd57f9cb405631074dca840d03929b5c12900c3f64826c
MD5 hash: 32ad70012e8f925c2f1ea5d73d8dd194
MIME type:application/octet-stream
Signature Amadey
File name:libcurl.dll
File size:323'256 bytes
SHA256 hash: 5b6b6a5859e8a9bf6f64b2f05dbf9693ee028d8cc673991da37c9ea5116b7b2e
MD5 hash: 1824ec8765523b8bbc77b14f665f842a
MIME type:application/x-dosexec
Signature Amadey
File name:Qt5Core.dll
File size:6'196'048 bytes
SHA256 hash: 45a830c44f93aba5658e5e9697de42b3f3eb383bbbf174ade65a78f9a6c7d8b2
MD5 hash: 5af1a8d3e720c2ecd7c835510429da9f
MIME type:application/x-dosexec
Signature Amadey
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6810bc99cc5fb3600cc469b7
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
microsoft_visual_cc signed
Link:
https://www.filescan.io/uploads/6810b8f646fe05453ca9ddba/reports/26f33e70-0d4b-4e8d-ab16-7f2a280650cc/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b
Score:
7%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-28 17:52:04 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3iqh3mircen5bsjx7n4eyknidvjqnisrvxxv2hnqss67afstqnnq._file
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:200131 discovery trojan
Link:
https://tria.ge/reports/250429-n488cs1mv7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Executes dropped EXE
Loads dropped DLL
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Amadey
Amadey family
Malware Config
C2 Extraction:
http://tackleoutplayed.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Rooter
Create hunting rule
Author:Seth Hardy
Description:Rooter
Rule name:RooterStrings
Create hunting rule
Author:Seth Hardy
Description:Rooter Identifying Strings
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:skip20_sqllang_hook
Create hunting rule
Author:Mathieu Tartare <mathieu.tartare@eset.com>
Description:YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:https://www.welivesecurity.com/
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

zip da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b

(this sample)

  
Link
https://tria.ge/250429-nj8q4axzfw/behavioral1
  
Dropped by
LummaStealer
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3529977/

Comments