MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments 1

SHA256 hash:	e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313
SHA3-384 hash:	4cd3afc9522d96b89f3dcb14d4d477d91b58a5ce5591eb55bd621b3e9999c22c45c7ca185a8bdc41f4bedad4120e2b4c
SHA1 hash:	12dfec1df517037846dea8044a0edc409b790a13
MD5 hash:	e507e6d6e53146d7c7d7560845d7b51c
humanhash:	floor-equal-hawaii-skylark
File name:	e507e6d6e53146d7c7d7560845d7b51c
Download:	download sample
Signature	Amadey Create hunting rule
File size:	129'024 bytes
First seen:	2022-06-09 00:16:50 UTC
Last seen:	2022-07-22 10:49:37 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	557f0c64436e04f97f66ceeb0911cbf0 (34 x Amadey)
ssdeep	3072:Qx7p5EJTJ0/DL5nr0Z2fgnXKSxN07IXauEed0Kj6a9:Qx7810/DJ0Z2fjgrEeR
Threatray	133 similar samples on MalwareBazaar
TLSH	T12AC35C73F1D08872D0B10E7CAD5AE6D8663EFE202C251557B6E94E4C2D3B6C2296C6C7
TrID	38.9% (.EXE) Win32 Executable Delphi generic (14182/79/4) 18.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 12.3% (.EXE) Win32 Executable (generic) (4505/5/1) 8.2% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	zbetcheckin
Tags:	32 Amadey dll exe

Intelligence

File Origin

# of uploads :

# of downloads :

340

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/277932/

Detection(s):

Win.Malware.Zusy-9753108-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey greyware spybot stealer zusy

Link:

https://www.filescan.io/uploads/62a13c3bc221aaaa25c1fece/reports/ed0cdb10-4d1f-4be4-b1b9-ab31a0d046b0/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/90a5ca86-a33f-4eff-b0bc-874bc7aa7353

Result

Threat name:

Amadey

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1009508

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected Amadeys stealer DLL

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313/

Threat name:

Win32.Infostealer.Decred

Status:

Malicious

First seen:

2022-06-08 22:57:52 UTC

File Type:

PE (Dll)

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4smdgqip5jj7czsshtewb7d5mdo7z5qnb7baetti3ov2wj6oqmjq._file

Verdict:

malicious

Result

Malware family:

amadey

Score:

10/10

Tags:

family:amadey collection spyware stealer trojan

Link:

https://tria.ge/reports/220609-ak2ghsgdgp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_win_path

Accesses Microsoft Outlook profiles

Reads local data of messenger clients

Amadey

Detect Amadey credential stealer module

Unpacked files

SH256 hash:

e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313

MD5 hash:

e507e6d6e53146d7c7d7560845d7b51c

SHA1 hash:

12dfec1df517037846dea8044a0edc409b790a13

Link:

https://www.unpac.me/results/64f52994-0c12-47dd-a23f-513c7d553296/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e49833410fea/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.