MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585
SHA3-384 hash: aa638fa3d27ad82c772fd0c2974db6f3d3bf4226e0d6fb95a6531f63b269d7c3b45fdc2668de69832c89ea5f05cf6d5b
SHA1 hash: d1cf4af3c1374c28e599b8268e26575408fe097f
MD5 hash: 2216166931f6637107d3476fe0665bc1
humanhash: michigan-bakerloo-floor-india
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:6'084'096 bytes
First seen:2023-01-11 21:50:02 UTC
Last seen:2023-01-12 19:31:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:AcFIu6ku9kY0CsNTf2SWPZX8LysvzlRKhSJfX4D5qBM4yX7Jwly7WeZqNDBpU48Y:AcIulC0QsbX4DYB8+y7Wh9UXfnz
Threatray 1'165 similar samples on MalwareBazaar
TLSH T1D75666D9921CA4E5B92AA8F8BFD43FC7BC5337F47A6A08D1E0144168C9482C7C6D5E9C
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:Amadey exe


Avatar
andretavare5
Sample downloaded from https://speedfilehost.xyz/josina.exe

Intelligence

File Origin
# of uploads :
272
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-11 21:51:13 UTC
Tags:
trojan amadey loader evasion stealer vidar
Link:
https://app.any.run/tasks/c71fc68f-89b8-4872-a469-aa03c086da37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Fabookie Infostealer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/352075/
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILZilla.9891.1215.32432.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a process with a hidden window
Launching a process
Launching cmd.exe command interpreter
Creating a window
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Sending a custom TCP request
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm
Link:
https://www.filescan.io/uploads/63bf2f11dde391056ac23bfc/reports/f755cd8d-f3d1-4680-8de2-637cd3eb9c99/overview
Result
Verdict:
MALICIOUS
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/77a79939-27e6-4913-a3bd-b23b83531fe4
Result
Threat name:
Amadey, Fabookie, ManusCrypt, Socelars,
Create hunting rule
Detection:
malicious
Classification:
phis.bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1149926
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Creates processes via WMI
Detected VMProtect packer
Installs new ROOT certificates
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)
Sets debug register (to hijack the execution of another thread)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Instant Messenger accounts or passwords
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Amadeys stealer DLL
Yara detected Fabookie
Yara detected ManusCrypt
Yara detected Socelars
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 782656 Sample: file.exe Startdate: 11/01/2023 Architecture: WINDOWS Score: 100 141 Multi AV Scanner detection for domain / URL 2->141 143 Malicious sample detected (through community Yara rule) 2->143 145 Antivirus detection for URL or domain 2->145 147 15 other signatures 2->147 10 file.exe 5 2->10         started        13 rundll32.exe 2->13         started        15 nbveek.exe 2->15         started        process3 file4 93 C:\Users\user\AppData\Local\Temp\wangjj.exe, PE32 10->93 dropped 95 C:\...\build_2023-01-06_10-15_protected.exe, PE32 10->95 dropped 97 C:\Users\user\AppData\Local\...\Player3.exe, PE32 10->97 dropped 99 C:\Users\user\AppData\Local\...\file.exe.log, CSV 10->99 dropped 17 Player3.exe 3 10->17         started        21 wangjj.exe 2 10->21         started        23 build_2023-01-06_10-15_protected.exe 12 10->23         started        26 rundll32.exe 13->26         started        process5 dnsIp6 87 C:\Users\user\AppData\Local\...\nbveek.exe, PE32 17->87 dropped 149 Antivirus detection for dropped file 17->149 151 Multi AV Scanner detection for dropped file 17->151 153 Machine Learning detection for dropped file 17->153 155 Contains functionality to inject code into remote processes 17->155 28 nbveek.exe 27 17->28         started        157 Creates processes via WMI 21->157 33 conhost.exe 21->33         started        35 wangjj.exe 3 21->35         started        113 149.154.167.99 TELEGRAMRU United Kingdom 23->113 115 49.12.113.110 HETZNER-ASDE Germany 23->115 159 Writes to foreign memory regions 26->159 161 Allocates memory in foreign processes 26->161 163 Creates a thread in another existing process (thread injection) 26->163 37 svchost.exe 26->37 injected 39 svchost.exe 26->39 injected 41 svchost.exe 26->41 injected 43 7 other processes 26->43 file7 signatures8 process9 dnsIp10 117 77.73.134.27 FIBEROPTIXDE Kazakhstan 28->117 119 104.21.70.228 CLOUDFLARENETUS United States 28->119 125 2 other IPs or domains 28->125 101 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32+ 28->101 dropped 103 C:\Users\user\AppData\Local\...\handdiy_1.exe, PE32 28->103 dropped 105 C:\Users\user\AppData\Local\...\random.exe, PE32 28->105 dropped 109 5 other malicious files 28->109 dropped 165 Antivirus detection for dropped file 28->165 167 Multi AV Scanner detection for dropped file 28->167 169 Creates an undocumented autostart registry key 28->169 175 2 other signatures 28->175 45 handdiy_1.exe 28->45         started        49 random.exe 28->49         started        51 pb1111.exe 28->51         started        62 3 other processes 28->62 53 rundll32.exe 33->53         started        121 8.8.8.8 GOOGLEUS United States 35->121 123 188.114.96.3 CLOUDFLARENETUS European Union 35->123 107 C:\Users\user\AppData\Local\Temp\db.dll, PE32 35->107 dropped 55 conhost.exe 35->55         started        171 Sets debug register (to hijack the execution of another thread) 37->171 173 Modifies the context of a thread in another process (thread injection) 37->173 57 svchost.exe 37->57         started        60 nbveek.exe 39->60         started        file11 signatures12 process13 dnsIp14 127 148.251.234.83 HETZNER-ASDE Germany 45->127 129 149.28.253.196 AS-CHOOPAUS United States 45->129 177 Antivirus detection for dropped file 45->177 179 Multi AV Scanner detection for dropped file 45->179 181 Machine Learning detection for dropped file 45->181 64 WerFault.exe 45->64         started        67 WerFault.exe 45->67         started        183 Creates processes via WMI 49->183 69 random.exe 49->69         started        71 conhost.exe 49->71         started        131 157.240.17.35 FACEBOOKUS United States 51->131 137 3 other IPs or domains 51->137 133 192.168.2.1 unknown unknown 53->133 185 System process connects to network (likely due to code injection or exploit) 53->185 187 Tries to steal Instant Messenger accounts or passwords 53->187 189 Tries to harvest and steal ftp login credentials 53->189 73 tar.exe 53->73         started        135 208.95.112.1 TUT-ASUS United States 57->135 139 2 other IPs or domains 57->139 89 C:\Users\user\AppData\Local\...\Cookies.db, SQLite 57->89 dropped 91 C:\Users\user\AppData\Local\...\Login Data.db, SQLite 57->91 dropped 191 Query firmware table information (likely to detect VMs) 57->191 193 Installs new ROOT certificates 57->193 195 Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically) 57->195 197 Tries to harvest and steal browser information (history, passwords, etc) 57->197 75 conhost.exe 62->75         started        77 conhost.exe 62->77         started        79 cmd.exe 1 62->79         started        81 5 other processes 62->81 file15 signatures16 process17 dnsIp18 111 20.189.173.22 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 64->111 83 conhost.exe 69->83         started        85 conhost.exe 73->85         started        process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585/
Threat name:
ByteCode-MSIL.Downloader.ShortLoader
Create hunting rule
Status:
Malicious
First seen:
2023-01-11 21:51:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
24 of 26 (92.31%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5z54xyb3i7ojppu76qgtcsazvgo25bopuvcpojv32wosutlxawcq._file
Verdict:
malicious
Similar samples:
083fab59465c8091dcf00e065b8c4ba9d434723d6649d2ab47299a2ac145fc1f
Amadey
1353cc6a409dbc1ede12344c5e6a91af81520682e5d1eefa5f0b9d1b4145b2f4
Amadey
2fbf3507320d77ce68ad429c66ddcf0d53cedcb3cf8396c1057c820737bf9e11
Amadey
384754e8def3862ee5805476c1c45bbec16d56175dc82438927e02cd98292b24
Amadey
5c9a81384d49768cd3d01f0786a2c957a8b63da55668fe0270eaef8b3eb2299a
Amadey
7157c19376fe21e77622d0d53b0c6aae720a02fab458db18ac83bde136cede16
Amadey
9ca648fad08d86feab816bb3116a5f0439c372d65b9382778c72d704ad50abd2
Amadey
e3a1001bfe5f5d08e9ca9b2bad47090707a272a533cda0299f6ecb514a46036d
Amadey
f63dc116cf6f2bf6c2f33898d73ef0b974ed3fa9de67d840b50b35ee2d9390d9
Amadey
+ 1'155 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:socelars family:vidar botnet:494 discovery spyware stealer trojan vmprotect
Link:
https://tria.ge/reports/230111-1pyvasad5x/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Unexpected DNS network traffic destination
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
Amadey
Process spawned unexpected child process
Socelars
Socelars payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Malware Config
C2 Extraction:
77.73.134.27/8bmdh3Slb2/index.php
https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923
https://hdbywe.s3.us-west-2.amazonaws.com/adwwe09/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c2a20349-32ba-4ccb-9d69-973651fdb539
Gathering data
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ee7bcbe03b47/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_DLInjector04
Create hunting rule
Author:ditekSHen
Description:Detects downloader / injector
Rule name:msil_rc4
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Links
Create hunting rule
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/352075/
  
URLhaus
https://urlhaus.abuse.ch/url/2505213/

Comments