MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 17

Intelligence 17 IOCs 1 YARA 18 File information Comments

SHA256 hash:	0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62
SHA3-384 hash:	6c76324f7a7c7b83db2a3c6712c1db273814d15546bdc9ac6794cadaae6215bed7d33a710b4708f786e91b8cd15d8810
SHA1 hash:	23342b7ebb39821aaaef39a2f976f0a14450a896
MD5 hash:	be188838384f6b0226efe5c6852bd0f1
humanhash:	potato-coffee-maryland-india
File name:	0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	361'472 bytes
First seen:	2025-07-05 11:50:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f37943ad193a52d7b21e245b891de4bf (7 x Amadey, 2 x TeamBot, 1 x CobaltStrike)
ssdeep	6144:uO/djLXieoWqsvemVN2rTluKnRFD5WP8HOgJ/z:rDieXq2pGrTUKnRFD5WPkJ
TLSH	T1DA74E12A35F0C0B2D44B14344928DBB4AE7EB8319A64B2D733941ABE5E303D19F7B765
TrID	37.3% (.EXE) Win64 Executable (generic) (10522/11/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	103064c0c0aac800 (7 x Amadey)
Reporter	abuse_ch
Tags:	Amadey exe

abuse_ch

Amadey C2:
http://91.219.239.20/dF30Hn4m/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://91.219.239.20/dF30Hn4m/index.php	https://threatfox.abuse.ch/ioc/1553613/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

8C4AF4AAB523A1F2045E69174A28C40D.exe

Verdict:

Malicious activity

Analysis date:

2025-07-05 07:59:07 UTC

Tags:

lumma stealer themida loader amadey botnet telegram auto-reg vidar rdp autoit github evasion stealc qrcode

Link:

https://app.any.run/tasks/8041cea5-63f8-4e23-9498-2706e7115b28

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/12410/

Detection(s):

Sanesecurity.Malware.28986.BadIN.UNOFFICIAL

Sanesecurity.Malware.28988.BadIN.UNOFFICIAL

Win.Packer.pkr_ce1a-9980177-0

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6869118a900df8e7f867102e

Tags:

shellcode autorun trojan sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc overlay packed packed zero

Link:

https://www.filescan.io/uploads/68691188f638235d73f74a68/reports/31cfea82-860b-4639-8f01-6356cc7de750/overview

Verdict:

Malicious

Labled as:

Trojan.Ransom.Loki

Link:

https://www.hybrid-analysis.com/sample/0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/06f5bd96-9dbd-44f1-b742-983b5884419a

Result

Threat name:

Amadey

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1729175

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadey bot

Yara detected Amadeys stealer DLL

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/be188838384f6b0226efe5c6852bd0f1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62/

Verdict:

Malicious

Threat:

Win32.Ransomware.StopCrypt

Link:

https://tip.neiki.dev/file/0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2025-07-05 07:28:59 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=anrfqcqkncihhzn5wrkpvaq37qk2t7obvjflgvxascgc7zs7nnra._file

Result

Malware family:

amadey

Score:

10/10

Tags:

family:amadey botnet:fd2ac1 discovery execution persistence trojan

Link:

https://tria.ge/reports/250705-nztl4syqs3/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Checks computer location settings

Executes dropped EXE

Amadey

Amadey family

Malware Config

C2 Extraction:

http://212.118.43.106

Verdict:

Malicious

Tags:

Win.Packer.pkr_ce1a-9980177-0 Amadey

YARA:

n/a

Link:

https://app.threat.zone/submission/9a60aa89-06be-463a-82bb-dd64001b50cc

Unpacked files

SH256 hash:

0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62

MD5 hash:

be188838384f6b0226efe5c6852bd0f1

SHA1 hash:

23342b7ebb39821aaaef39a2f976f0a14450a896

Link:

https://www.unpac.me/results/c0f8a863-0ce7-46ab-b1ec-74569f81dde5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Amadey Create hunting rule
Author:	kevoreilly
Description:	Amadey Payload

Rule name:	amadeystealer Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked amadey malware samples.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_Amadey Create hunting rule
Author:	ditekSHen
Description:	Amadey downloader payload

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Generic_Threat_1f2e969c Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Generic_2993e5a5 Create hunting rule
Author:	Elastic Security

Rule name:	win_amadey_a9f4 Create hunting rule
Author:	Johannes Bader
Description:	matches unpacked Amadey samples

Rule name:	win_amadey_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.amadey.

Rule name:	win_amadey_bytecodes_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

exe 0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62

(this sample)

Cape

https://www.capesandbox.com/analysis/12410/

URLhaus

https://urlhaus.abuse.ch/url/3576635/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasExesLengthA KERNEL32.dll::GetConsoleAliasesW KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::GetWindowsDirectoryW KERNEL32.dll::GetFileAttributesW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample