MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f52befe41f104a7127ffbe375bb8094d083060d8b30d0fde45a03ce67bbb6da8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 6

Intelligence 6 IOCs YARA 53 File information Comments

SHA256 hash:	f52befe41f104a7127ffbe375bb8094d083060d8b30d0fde45a03ce67bbb6da8
SHA3-384 hash:	cee9d451e96dac85d9c1141afaeddff1411db853fdbc293c721454a034707655061590ab55abf6d0194c90b26f934d18
SHA1 hash:	21570f328bc100444a532424d65a90e433c345fb
MD5 hash:	b77b6876345ed520557611380450cacc
humanhash:	triple-winner-violet-edward
File name:	main.3.zip
Download:	download sample
Signature	Amadey Create hunting rule
File size:	21'926'600 bytes
First seen:	2025-03-15 13:17:57 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:k/xVQ6gudnbEOds37F7i3SCnFHVxk4n5unhrN/dKb58GeNS+WCvuN870O:8k6guJp+37F7i3SEFHTP5unPdKZ7+3u8
TLSH	T1272733ECCDF7489C28BA9823E4B4EA118F9941634553DA7CBB25A747DDDBBC8019C1C2
Magika	zip
Reporter	aachum
Tags:	Amadey zip

iamaachum

https://github.com/Milidmdds/jdhfjshdjf/releases/download/dfsdfsd/main.3.zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	main.exe
File size:	54'340'615 bytes
SHA256 hash:	e2a9b975d2fb8c79886cf00b603040b7fd335a6a985a5d582b840129a36bc61a
MD5 hash:	a7fcbfb7bbcfd61260138ae38f05fae8
MIME type:	application/x-dosexec
Signature	Amadey

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d58bbd3962f1a6f471a2c0

Tags:

n/a

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/f52befe41f104a7127ffbe375bb8094d083060d8b30d0fde45a03ce67bbb6da8/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey anti-debug crypto evasive expand fingerprint lolbin microsoft_visual_cc nexe oct overlay packed

Link:

https://www.filescan.io/uploads/67d57e25b03273ba9970f116/reports/3c2a6a21-fa2d-47c2-8c7c-c6550cbffbd8/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f52befe41f104a7127ffbe375bb8094d083060d8b30d0fde45a03ce67bbb6da8

Score:

85%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250315-wh3sfstjw7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Enumerates processes with tasklist

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202409_html_FedEx_phish Create hunting rule
Author:	abuse.ch
Description:	Detects potential HTML FedEx phishing forms

Rule name:	Agent_BTZ Create hunting rule

Rule name:	APT_Bitter_ZxxZ_Downloader Create hunting rule
Author:	SECUINFRA Falcon Team (@SI_FalconTeam)
Description:	Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:	https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh

Rule name:	attack_India Create hunting rule

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Nexe Create hunting rule
Author:	nwunderly

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	reverse_http Create hunting rule
Author:	CD_R0M_
Description:	Identify strings with http reversed (ptth)

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

Rule name:	win_amadey_bytecodes_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

Rule name:	win_karius_g0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/