| File name: | IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].zip |
| Full analysis: | https://app.any.run/tasks/99a43c0d-f1a3-4bbb-917d-a917d3a25bf5 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | July 06, 2025, 03:07:48 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | 6F7409CE070C062CD17C4D4121D3951B |
| SHA1: | 9D9A7ED2F249642DB0BC82DAECC6547E321C524A |
| SHA256: | A54D1C9DC0D2C7080A99B90530D0C2C1117E9A7A03F7C71644F04BF6ABD2324D |
| SSDEEP: | 98304:i6SvFtvpZXiXXHYeF81hj+cPi/fG+jcnid2AKVb2hHapSXVtzPOX4JzvXedLEX4P:wjH |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2020:10:31 02:15:50 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | config/ |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 592 | "PowerShell.exe" -NoProfile -NonInteractive -Command - | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | regsvr32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 684 | "C:\WINDOWS\system32\svchost.exe" | C:\Windows\System32\svchost.exe | systaxpcosx.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 1976 | "regsvr32.exe" /s /i:INSTALL "C:\Users\admin\AppData\Roaming\microsoft\systemcertificates\\8TextInputServices.pfx" | C:\Windows\SysWOW64\regsvr32.exe | — | vbdvbccw.tmp |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 2072 | "C:\Users\admin\AppData\Local\Temp\is-TTTS7.tmp\vbdvbccw.tmp" /SL5="$130334,696294,301056,C:\Users\admin\AppData\Roaming\vbdvbccw.exe" /VERYSILENT | C:\Users\admin\AppData\Local\Temp\is-TTTS7.tmp\vbdvbccw.tmp | vbdvbccw.exe | |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 | ||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | |
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 2324 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
| 2380 | "IptvRChecker.exe" | C:\Users\admin\Desktop\IPTV Tools 1.1.6 Premium_Cracked[@hacklabb]\IptvRChecker.exe | Launcher.exe | |
User: admin Company: Daniel Simons Studios Integrity Level: MEDIUM Description: IPTV Tools by Daniel Exit code: 3762504530 Version: 1.1.6.0 | ||||
| 2468 | "C:\Users\admin\AppData\Roaming\systaxpcosx.exe" | C:\Users\admin\AppData\Roaming\systaxpcosx.exe | Launcher.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: System Exit code: 0 Version: 2.0.0.1 | ||||
| 2692 | "C:\Users\admin\AppData\Roaming\vbdvbccw.exe" | C:\Users\admin\AppData\Roaming\vbdvbccw.exe | IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].exe | |
User: admin Company: Integrity Level: MEDIUM Description: Attribute Utility Setup Exit code: 1 Version: | ||||
| 3048 | "C:\Users\admin\AppData\Roaming\gfgfrxr.exe" | C:\Users\admin\AppData\Roaming\gfgfrxr.exe | — | IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].exe |
User: admin Company: Installer Integrity Level: MEDIUM Description: Installer Exit code: 0 Version: 1.0.0.1 | ||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4772 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 4832 | WinRAR.exe | C:\Users\admin\Desktop\IPTV Tools 1.1.6 Premium_Cracked[@hacklabb]\MetroFramework.Fonts.dll | executable | |
MD5:65EF4B23060128743CEF937A43B82AA3 | SHA256:C843869AACA5135C2D47296985F35C71CA8AF4431288D04D481C4E46CC93EE26 | |||
| 3704 | bvxbvbvf.exe | C:\ProgramData\bbeecafdaeec.exe | executable | |
MD5:F6D564F25159E650D1A16192E4C56227 | SHA256:AE83F5C0C261DBD56BF00DA9DA8DE6581788B3C26B70615742E5733A8C304BC9 | |||
| 3672 | IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].exe | C:\Users\admin\AppData\Roaming\bvxbvbvf.exe | executable | |
MD5:F6D564F25159E650D1A16192E4C56227 | SHA256:AE83F5C0C261DBD56BF00DA9DA8DE6581788B3C26B70615742E5733A8C304BC9 | |||
| 7028 | yutuytt.exe | C:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\layout.xml | xml | |
MD5:4526724CD149C14EF9D37D86F825B9F7 | SHA256:138167D8F03D48E88DA0AEC3DF38F723BC1895822F75660CCCB5E994814BEE90 | |||
| 4832 | WinRAR.exe | C:\Users\admin\Desktop\IPTV Tools 1.1.6 Premium_Cracked[@hacklabb]\images\pause.png | image | |
MD5:A97A4FD94583E624FD7E17D74F98905F | SHA256:80EB2C6FFE735302A4E9062984B8F82DAFA904B2B8EAC5D735E82B7F8AAA4D93 | |||
| 3672 | IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].exe | C:\Users\admin\AppData\Roaming\yutuytt.exe | executable | |
MD5:457D94BCF08A6F3ED948EC248C9170E8 | SHA256:8F2A8FFF0F305A65B13BB4FB25577F7185887BB022E6BEC7E74935893214A9D7 | |||
| 3672 | IPTV Tools 1.1.6 Premium_Cracked[@hacklabb].exe | C:\Users\admin\AppData\Roaming\vbdvbccw.exe | executable | |
MD5:5235983724705B359C8248A6D84C416D | SHA256:198F737D5A64D2A44FAE287C50929D208E2D4CEE9A77C1605E56F7D04799ED42 | |||
| 4832 | WinRAR.exe | C:\Users\admin\Desktop\IPTV Tools 1.1.6 Premium_Cracked[@hacklabb]\images\play.png | image | |
MD5:706A7F496F0225ED5FE2C2CB4923132E | SHA256:EA9D4CE8BB78E3C616C1406A340023C3D0F528E66BD65B8F3637EC6019AC6A31 | |||
| 4832 | WinRAR.exe | C:\Users\admin\Desktop\IPTV Tools 1.1.6 Premium_Cracked[@hacklabb]\Alert.wav | binary | |
MD5:CB33DEF3CE7F9B4E43D83C34D28484BD | SHA256:81998B8A753A2E6D41498EECDD70F814796E6E095E9F1BB1B07EDFD2CC8830D7 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6304 | WerFault.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3704 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4320 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3704 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6304 | WerFault.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3688 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4320 | svchost.exe | 40.126.31.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4320 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
diamotrix.world |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Diamotrix Clipper Domain (diamotrix .world) in DNS Lookup |