MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 20

Intelligence 20 IOCs 1 YARA 9 File information Comments

SHA256 hash:	0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3
SHA3-384 hash:	0b3f94b563029c726a5dfe1a9e63505ca30379c6d2846ee7d448b98c3e4767f6fd4a6424fdff8e1aa150ab97e7f9f1c6
SHA1 hash:	2b72a161406eada60bb3b6915e9955a867d10b9a
MD5 hash:	e6dc999c60fbea46a3894ba0ffc5b972
humanhash:	zebra-snake-music-pennsylvania
File name:	random.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	2'625'024 bytes
First seen:	2025-09-17 07:50:20 UTC
Last seen:	2025-09-17 09:45:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	49152:YN1YPKufhtRP+RoERsl1vbKxyZ5gqZQPYGlynFdtlQ1ygRP/OhuA:Y3uZtRP89W1v9+YGlqftq5RH
Threatray	500 similar samples on MalwareBazaar
TLSH	T15CC5332707BCAFEAEAA6AEF120A57D11EB7431CC5268E190540E338958F3ED36F11855
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	abuse_ch
Tags:	Amadey exe

abuse_ch

Amadey C2:
107.189.23.136:7720

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
107.189.23.136:7720	https://threatfox.abuse.ch/ioc/1593283/

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

2c7dbdd57aed9a810140e38e92fb5f7b171f3bb319a8688c57b9548ab8e6a128.exe

Verdict:

Malicious activity

Analysis date:

2025-09-17 07:34:03 UTC

Tags:

auto redline stealer lumma amadey unlocker-eject tool arch-exec botnet themida rdp

Link:

https://app.any.run/tasks/98391658-869c-4da4-8a9e-760d4b0cad75

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/27878/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ca6881243203254647187d

Tags:

phishing emotet delphi

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Windows directory

Enabling the 'hidden' option for recently created files

Launching a process

Creating a process with a hidden window

Creating a service

Launching a service

Restart of the analyzed sample

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Running batch commands

Creating a process from a recently created file

Creating a window

Searching for the window

Launching the default Windows debugger (dwwin.exe)

Creating a file

Enabling autorun for a service

Connection attempt to an infection source

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

cmd lolbin obfuscated packed reconnaissance sc schtasks

Link:

https://www.filescan.io/uploads/68ca687973287948292cf879/reports/6233f97c-af07-4282-9b52-b1affae51b3c/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-17T04:40:00Z UTC

Last seen:

2025-09-17T04:40:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce8ba768-0deb-457f-98ab-371d2d13e946

Result

Threat name:

Amadey, LummaC Stealer, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1779055

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Drops executables to the windows directory (C:\Windows) and starts them

Drops password protected ZIP file

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Sigma detected: PUA - NSudo Execution

Sigma detected: Suspicious New Service Creation

Suricata IDS alerts for network traffic

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the nircmd tool (NirSoft)

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected LummaC Stealer

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/e6dc999c60fbea46a3894ba0ffc5b972

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3/

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2025-09-17 07:34:03 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=abdkyflkz7jxoz3lhnvffhun25bg2bmpecup6rc5i4juwaxfzdbq._file

Verdict:

malicious

Label(s):

admintool_nircmd

admintool_nsudo

unc_loader_051

lummastealer

amadey

Result

Malware family:

socks5systemz

Score:

10/10

Tags:

family:amadey family:donutloader family:gcleaner family:lumma family:socks5systemz botnet:fbf543 botnet collection credential_access defense_evasion discovery execution loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/250917-jp2shsw1a1/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry key

Modifies system certificate store

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in Windows directory

Launches sc.exe

Enumerates processes with tasklist

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Creates new service(s)

Downloads MZ/PE file

Sets service image path in registry

Stops running service(s)

Uses browser remote debugging

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Amadey

Amadey family

Detect Socks5Systemz Payload

Detects DonutLoader

Disables service(s)

DonutLoader

Donutloader family

GCleaner

Gcleaner family

Lumma Stealer, LummaC

Lumma family

Socks5Systemz

Socks5systemz family

Malware Config

C2 Extraction:

http://94.154.35.25
https://t.me/romalabs4
https://consnbx.su/sawo
https://lexenorf.org/zdhs
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://newflux75.xyz/xkzp
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd
https://yunded.com/uwuz
https://todoexy.su/xqts
https://rhusdniw.shop/teyg
185.156.73.98
45.91.200.135

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/677735cc-d860-4adf-aede-93da889bb72c

Unpacked files

SH256 hash:

0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3

MD5 hash:

e6dc999c60fbea46a3894ba0ffc5b972

SHA1 hash:

2b72a161406eada60bb3b6915e9955a867d10b9a

Link:

https://www.unpac.me/results/39168b5c-47d6-4aec-b9f4-f9fe0feadab5/

SH256 hash:

d7ef85da4d2b3640154ff4ff0972a6d90a4a0e75cdf3039f0dfc3ed832c931af

MD5 hash:

37836ed6ea8a0ac67b2aeb80443ebc16

SHA1 hash:

640669ee79eacce5e95419f878a1f12a6ae4b6f2

Detections:

Amadey

Link:

https://www.unpac.me/results/39168b5c-47d6-4aec-b9f4-f9fe0feadab5/

SH256 hash:

774953c4f9fbf6e53c0f902917cc3c79192890b661d8b2a0d5c2a4652d4f7d1c

MD5 hash:

7343ecf2516c52310b372f017a0a3a0d

SHA1 hash:

a8d2d3e1367764d4cacfe58883f665c3433fcb30

Link:

https://www.unpac.me/results/39168b5c-47d6-4aec-b9f4-f9fe0feadab5/

SH256 hash:

c0fa6aec76a72060891f424c528c6981273dca29ca6530ae5a7d0c695b0760ff

MD5 hash:

0f72dfca6013a500144f85926b672ce7

SHA1 hash:

fbabf49bb0ad00356cc446154a1ef7fcac03d11e

Link:

https://www.unpac.me/results/39168b5c-47d6-4aec-b9f4-f9fe0feadab5/

SH256 hash:

c39c4466f622b7320076076ea3eb13fa0f784b9b097dff46d802f905fc39d851

MD5 hash:

a7993e5a520b17fec65435fb4838a08f

SHA1 hash:

18fe6286473a03735e7b701d4bfaf61ad35da7ad

Link:

https://www.unpac.me/results/39168b5c-47d6-4aec-b9f4-f9fe0feadab5/

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0046ac156acf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0046ac156acfd377676b3b6a529e8dd7426d058f20a8ff445d47134b02e5c8c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)