MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
SHA3-384 hash: bffec35cd10b3a78275ac9643861123323eab5adf28e4a3ba8aec14cea211cd81afd4d7f648d1bcb737e0b954b13a940
SHA1 hash: c9186ff53de4724ede20c6485136b4b2072bb6a6
MD5 hash: f9a4f6684d1bf48406a42921aebc1596
humanhash: apart-equal-saturn-fillet
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:492'544 bytes
First seen:2024-08-13 19:12:08 UTC
Last seen:2024-08-24 04:00:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0275392671bba1542f88797f29212ff8 (1 x Amadey)
ssdeep 12288:UHdftnB3Zp+52J9+62HHLhJ3er8XSwW0:UNz3ZwwJ9+7HFnXP
TLSH T1C6A4F0183181D030C1A219749C78C6FE1A7E7D5394B7589B3B683FAB3E716816DB23A7
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 1a72c2da98585c0c (16 x Stealc, 3 x Smoke Loader, 2 x Vidar)
Reporter Bitsight
Tags:Amadey exe


Avatar
Bitsight
url: http://82.147.85.52/build2.exe

Intelligence

File Origin
# of uploads :
15
# of downloads :
430
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-08-13 19:19:56 UTC
Tags:
amadey botnet stealer loader
Link:
https://app.any.run/tasks/1d5108b4-6160-4bef-b464-54fbb15b9665

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66bbb040aa5b40be0aa02a1a
Tags:
Stealth Trojan
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint lolbin microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/66bbb03f32f6d05ff3cc5082/reports/d48eb926-5826-4244-bb80-5741bf661de4/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c43b9447-630a-48ee-ad92-c5e9d0ee11b2
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1492440
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1492440 Sample: file.exe Startdate: 13/08/2024 Architecture: WINDOWS Score: 100 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 7 other signatures 2->64 7 file.exe 5 2->7         started        11 Hkbsse.exe 2->11         started        process3 file4 32 C:\Users\user\AppData\Local\...\Hkbsse.exe, PE32 7->32 dropped 34 C:\Users\user\...\Hkbsse.exe:Zone.Identifier, ASCII 7->34 dropped 66 Detected unpacking (changes PE section rights) 7->66 68 Detected unpacking (overwrites its own PE header) 7->68 70 Contains functionality to inject code into remote processes 7->70 13 Hkbsse.exe 7->13         started        18 WerFault.exe 7->18         started        20 WerFault.exe 16 7->20         started        22 9 other processes 7->22 signatures5 process6 dnsIp7 54 193.176.158.185 AGROSVITUA unknown 13->54 36 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32+ 13->36 dropped 38 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 13->38 dropped 40 C:\Users\user\AppData\Local\...\cred64[1].dll, PE32+ 13->40 dropped 42 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 13->42 dropped 72 Multi AV Scanner detection for dropped file 13->72 74 Detected unpacking (changes PE section rights) 13->74 76 Detected unpacking (overwrites its own PE header) 13->76 24 WerFault.exe 13->24         started        26 WerFault.exe 13->26         started        28 WerFault.exe 13->28         started        30 WerFault.exe 13->30         started        56 52.182.143.212 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->56 44 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->44 dropped 46 C:\ProgramData\Microsoft\...\Report.wer, Unicode 20->46 dropped 48 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->48 dropped 50 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->50 dropped 52 7 other malicious files 22->52 dropped file8 signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-08-13 19:13:05 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4cqfd6j5jqpidtauega5cqsj4jdl4tawszc5mzzgoe2lmzhhkbba._file
Verdict:
malicious
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:cd33f9 credential_access discovery execution persistence privilege_escalation spyware stealer trojan
Link:
https://tria.ge/reports/240813-xw29hs1ere/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Wi-Fi Discovery
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads local data of messenger clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Blocklisted process makes network request
Downloads MZ/PE file
Credentials from Password Stores: Credentials from Web Browsers
Amadey
Malware Config
C2 Extraction:
http://193.176.158.185
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b21e8dc7-e873-4932-b959-06d930d3cabc
Unpacked files
SH256 hash:
e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
MD5 hash:
f9a4f6684d1bf48406a42921aebc1596
SHA1 hash:
c9186ff53de4724ede20c6485136b4b2072bb6a6
Link:
https://www.unpac.me/results/16a809e3-9f43-4f7c-8648-a94ba527ae87/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e0a051f93d4c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3105247/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System ShellSHELL32.dll::FindExecutableA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::SetProcessShutdownParameters
KERNEL32.dll::OpenSemaphoreA
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetDiskFreeSpaceExW
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::PeekConsoleInputA
KERNEL32.dll::SetConsoleCP
KERNEL32.dll::SetConsoleTextAttribute
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleAliasA
KERNEL32.dll::GetConsoleAliasesA
KERNEL32.dll::GetConsoleAliasesLengthA
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileA
KERNEL32.dll::ReplaceFileW
KERNEL32.dll::SetVolumeMountPointA

Comments