MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6
SHA3-384 hash:	1da0b50f2615f83b21a0cae82e81079b123d43f67406fc71b1331afc855d89acd7e746a70feeded488ae0aa0b2bcf014
SHA1 hash:	2224ebe3236a19ce11813a9a58ac417e38efdc98
MD5 hash:	86cd46f57887bb06b0908e4e082f09e4
humanhash:	five-lactose-sixteen-shade
File name:	86cd46f57887bb06b0908e4e082f09e4.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	3'213'824 bytes
First seen:	2025-02-27 19:26:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:MYX+D+eQiBooF3sC3iKxjFQz32pilmD5aj9yBYaC5k3U:e+eQ493s4iImz3oiQQj4BYajE
TLSH	T169E53B55A40562CFD8EE17B445E7CD4AB91E0AFC87102587AF6CB0B9BE63CC015E9E38
TrID	42.7% (.EXE) Win32 Executable (generic) (4504/4/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 19.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

435

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN amadey

Malware family:

amadey

Alert

Create hunting rule

ID:

1

File name:

daec7b03c98cabb50f94c5ddf9ca7063918b9859291caadaf4cb75f954a4ab30.exe

Verdict:

Malicious activity

Analysis date:

2025-02-27 04:32:53 UTC

Tags:

lumma stealer amadey botnet exfiltration loader gcleaner stealc telegram vidar auto generic rdp screenconnect remote redline metastealer themida

Link:

https://app.any.run/tasks/6a3c11e5-24b6-458d-9ff9-be728b79120e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c0bc874e50050b2e6edc4b

Tags:

shellcode phishing virus zusy

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Searching for analyzing tools

DNS request

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

crypt obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67c0bc6f3c5f644bd93b57dc/reports/8ebb53e9-1f1e-4f90-8572-1be69a9d967d/overview

Hybrid Analysis Zusy.Generic

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/4b8f0b4b-167f-4bd6-b8e7-15bae7e9a105

Joe Sandbox LummaC Stealer, Tofsee

Result

Threat name:

LummaC Stealer, Tofsee

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1625957

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Drops PE files to the user root directory

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Encoded PowerShell Command Line

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected LummaC Stealer

Yara detected Tofsee

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6/

ReversingLabs TitaniumCloud Win32.Trojan.Amadey

Threat name:

Win32.Trojan.Amadey

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-26 16:12:26 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

28 of 38 (73.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ztu32t7a7q6amqes3z44g2cwdt7hnagwk2if26na2525ykimxla._file

Threatray lummastealer amadey

Verdict:

malicious

Label(s):

lummastealer

Alert

Create hunting rule

amadey

Alert

Create hunting rule

Similar samples:

error

Vidar

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:amadey family:systembc family:vidar botnet:092155 botnet:a4d2cd botnet:ir7am credential_access defense_evasion discovery execution persistence spyware stealer trojan

Link:

https://tria.ge/reports/250227-x5ql3sxlt6/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

Modifies Control Panel

Modifies Internet Explorer settings

Modifies system certificate store

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in Windows directory

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Obfuscated Files or Information: Command Obfuscation

.NET Reactor proctector

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Uses browser remote debugging

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Amadey

Amadey family

Detect Vidar Stealer

SystemBC

Systembc family

Vidar

Vidar family

Malware Config

C2 Extraction:

http://176.113.115.6
https://t.me/l793oy
https://steamcommunity.com/profiles/76561199829660832
http://cobolrationumelawrtewarms.com
http://�������� jlgenfekjlfnvtgpegkwr.xyz
towerbingobongoboom.com
93.186.202.3

Dropper Extraction:

http://185.215.113.16/mine/random.exe

Threat.Zone Malicious

Verdict:

Malicious

Tags:

c2 lumma lumma_stealer stealer

YARA:

n/a

Link:

https://app.threat.zone/submission/4143a425-76a8-4261-a755-6b304bbdbf3b

UnpacMe 2

Unpacked files

SH256 hash:

18a6cfef890b0e4c7676cf1796d095b86a825bd28d8a69d90f781338aa9a2376

MD5 hash:

54e71c1e3239075c5636140c497695ee

SHA1 hash:

36f4afa8f2f451e5b7cc88f96527de6a66b5d784

Link:

https://www.unpac.me/results/1398b3f0-a828-44cc-a824-c890ee86aaa9/

SH256 hash:

fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6

MD5 hash:

86cd46f57887bb06b0908e4e082f09e4

SHA1 hash:

2224ebe3236a19ce11813a9a58ac417e38efdc98

Link:

https://www.unpac.me/results/1398b3f0-a828-44cc-a824-c890ee86aaa9/

VMRay Lumma

Malware family:

Lumma

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fe674dea7f07/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fe674dea7f07e1e0320496f3ce1b42b0e7f3b406b2b482ebcd06bbaee14865d6