MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 14


Intelligence 14 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04
SHA3-384 hash: 6381b166752f42a5bf7f7a67aa6c6d6e9b2f4211454850577b7e41d7045f204a048606a1d2604e26838262784f8bccc2
SHA1 hash: c7079f28c51bbe519989982060bffa05c925a73d
MD5 hash: 1711fbb2b67eb266df0a5396a8862db5
humanhash: edward-glucose-blue-georgia
File name:1711fbb2b67eb266df0a5396a8862db5.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:5'014'752 bytes
First seen:2024-01-17 06:30:11 UTC
Last seen:2024-01-17 08:25:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c1bd85c47a3d2c5743df7292e01168a7 (2 x AgentTesla, 1 x Amadey, 1 x Formbook)
ssdeep 49152:14rRPa0AyMAJwb4XGwlbSonkIEAPuF+c0xOGUOPnVStiHuFnY:LI1b6IEUO1OPVS8qY
Threatray 45 similar samples on MalwareBazaar
TLSH T1F8369E06A7D805D5E4ABC730CAAAD333D6B2FC260734874F0411D74E5EB3AE55E6B226
TrID 72.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
13.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.EXE) OS/2 Executable (generic) (2029/13)
2.5% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:Amadey exe signed

Code Signing Certificate

Organisation:Microsoft Code Signing PCA 2011
Issuer:Microsoft Code Signing PCA 2011
Algorithm:sha256WithRSAEncryption
Valid from:2024-01-17T05:01:50Z
Valid to:2025-01-17T05:01:50Z
Serial number: b2cbc0f2dad2b6fe59a51c4e98db03a4
Thumbprint Algorithm:SHA256
Thumbprint: cfeef0fb4751ae68260eef3bcc4a95d9b425cabc38e9320d83f3d3db95cc9b30
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
Amadey C2:
http://87.121.87.199/f7Vkbh7X/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
424
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04.exe
Verdict:
Malicious activity
Analysis date:
2024-01-17 06:30:37 UTC
Tags:
amadey botnet stealer
Link:
https://app.any.run/tasks/2644059d-dcc3-4d44-8330-055d27c690a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Amadey
Create hunting rule
Link:
https://www.capesandbox.com/analysis/471255/
Detection(s):
SecuriteInfo.com.Win64.PWSX-gen.4181.29490.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug control lolbin overlay packed
Link:
https://www.filescan.io/uploads/65a774278369fab94defe155/reports/6e74a33a-c668-4846-89ff-ef240a2e72af/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bd602d71-1018-464b-ba06-6ee351ef7287
Result
Threat name:
Amadey, RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1375872
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Disables UAC (registry)
Drops PE files with benign system names
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Schedule system process
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys stealer DLL
Yara detected Costura Assembly Loader
Yara detected RHADAMANTHYS Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1375872 Sample: 9moLZUm8FT.exe Startdate: 17/01/2024 Architecture: WINDOWS Score: 100 109 cryptotrendz.eu 2->109 119 Snort IDS alert for network traffic 2->119 121 Multi AV Scanner detection for domain / URL 2->121 123 Found malware configuration 2->123 125 14 other signatures 2->125 11 svchost.exe 2->11         started        14 9moLZUm8FT.exe 2 3 2->14         started        17 svchost.exe 2->17         started        19 7 other processes 2->19 signatures3 process4 file5 139 Writes to foreign memory regions 11->139 141 Allocates memory in foreign processes 11->141 143 Adds a directory exclusion to Windows Defender 11->143 21 wab.exe 23 11->21         started        25 powershell.exe 23 11->25         started        27 powershell.exe 11->27         started        101 C:\Users\user\AppData\Roaming\svchost.exe, PE32+ 14->101 dropped 145 Disables UAC (registry) 14->145 147 Drops PE files with benign system names 14->147 29 cmd.exe 1 14->29         started        32 powershell.exe 23 14->32         started        36 2 other processes 14->36 149 Injects a PE file into a foreign processes 17->149 38 3 other processes 17->38 103 C:\Windows\Temp\xlanmc5e.inf, Windows 19->103 dropped 105 C:\Windows\Temp\frqvlfwb.inf, Windows 19->105 dropped 151 Multi AV Scanner detection for dropped file 19->151 34 consent.exe 19->34         started        40 8 other processes 19->40 signatures6 process7 dnsIp8 111 87.121.87.199, 49731, 49732, 80 SKATTV-ASBG Bulgaria 21->111 113 cryptotrendz.eu 45.137.21.10 ROOTLAYERNETNL Netherlands 21->113 93 k1irORsqI65NK%E2%8...B%BFs%EF%BB%BFi.exe, PE32+ 21->93 dropped 95 C:\Users\user\AppData\...\k1irORsqI65NK64.exe, PE32+ 21->95 dropped 97 C:\Users\user\...\k1irORsqI65NK?o?s?i[1].exe, PE32+ 21->97 dropped 99 C:\Users\user\...\k1irORsqI65NK64[1].exe, PE32+ 21->99 dropped 42 k1irORsqI65NK64.exe 21->42         started        45 k1irORsqI65NK%E2%80%AEo%EF%BB%BFs%EF%BB%BFi.exe 21->45         started        47 conhost.exe 25->47         started        49 conhost.exe 27->49         started        161 Uses schtasks.exe or at.exe to add and modify task schedules 29->161 55 2 other processes 29->55 51 conhost.exe 32->51         started        163 Writes to foreign memory regions 34->163 53 conhost.exe 36->53         started        57 2 other processes 38->57 59 2 other processes 40->59 file9 signatures10 process11 signatures12 127 Multi AV Scanner detection for dropped file 42->127 129 Writes to foreign memory regions 42->129 131 Allocates memory in foreign processes 42->131 133 Modifies the context of a thread in another process (thread injection) 42->133 61 wab.exe 42->61         started        63 powershell.exe 42->63         started        135 Adds a directory exclusion to Windows Defender 45->135 137 Injects a PE file into a foreign processes 45->137 65 AddInProcess32.exe 45->65         started        69 cmd.exe 45->69         started        71 powershell.exe 45->71         started        73 powershell.exe 45->73         started        process13 dnsIp14 75 dialer.exe 61->75         started        79 WerFault.exe 61->79         started        81 conhost.exe 63->81         started        107 85.209.176.171 ASDETUKhttpwwwheficedcomGB United Kingdom 65->107 117 Tries to harvest and steal browser information (history, passwords, etc) 65->117 83 conhost.exe 69->83         started        85 schtasks.exe 69->85         started        87 conhost.exe 71->87         started        89 conhost.exe 73->89         started        signatures15 process16 dnsIp17 115 185.196.10.125 SIMPLECARRIERCH Switzerland 75->115 153 Found evasive API chain (may stop execution after checking mutex) 75->153 155 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 75->155 157 Tries to steal Mail credentials (via file / registry access) 75->157 159 2 other signatures 75->159 91 wmprph.exe 75->91         started        signatures18 process19
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04/
Threat name:
Win64.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-01-17 06:31:13 UTC
File Type:
PE+ (Exe)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6jxdo7hjlck4tuw2csblkzpp6wfo2iieuy4clylvaoeylq3ttuca._file
Verdict:
malicious
Similar samples:
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae
Amadey
3d04a3dba672f406e3d4767cda713716bb926acc0a6298ad1bd1d7908ac5c634
Amadey
4520e200bd01f6ffd786172f0b6d482510e8367055cf7082ab455b61554a0e32
Amadey
5a5a5ebdbcaac1a77e3b8aa6f439b37080c17076934930121601bb4e78b6dc8a
Amadey
71e9af5f139c8743a53390345e7f19199b17892955f0d4607340d7b651ac869d
Amadey
baf93636b866c7974ce40d6783425066ef229efe94c735d77e52fe6d953eadc5
Amadey
cdd242949c27e36165097665a7c381247579401853b06e88d2e430b55e115105
Amadey
fc05a007f7b6a6e4a69f15f1a31822957f3aae14a81e01e7c6eb9ceac0835a3b
Amadey
+ 35 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:rhadamanthys evasion stealer trojan
Link:
https://tria.ge/reports/240117-g92l5sbac5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Executes dropped EXE
Downloads MZ/PE file
Amadey
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
UAC bypass
Malware Config
C2 Extraction:
http://87.121.87.199
Unpacked files
SH256 hash:
f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04
MD5 hash:
1711fbb2b67eb266df0a5396a8862db5
SHA1 hash:
c7079f28c51bbe519989982060bffa05c925a73d
Link:
https://www.unpac.me/results/925ef2ff-131e-4350-aa8b-6abf8e1428dc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f26e377ce958/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly
Description:Amadey Payload
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:win_amadey_a9f4
Create hunting rule
Author:Johannes Bader
Description:matches unpacked Amadey samples
Rule name:win_amadey_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.amadey.
Rule name:win_amadey_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2749108/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/471255/

Comments