MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 19

Intelligence 19 IOCs YARA 19 File information Comments

SHA256 hash:	1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882
SHA3-384 hash:	bf00eceb1067a11c04cfea81aa52e8b3a855bb3f61f8d715b1d9d04bcd74fc27bab4036a35f84830c492e39c9de4efd9
SHA1 hash:	30aa9a92e8be58fdbf3b077d3fd3a6c8cbe890a0
MD5 hash:	735af08a6a65e4efc3f6d2c70427c0e5
humanhash:	robert-london-september-idaho
File name:	file
Download:	download sample
Signature	Amadey Create hunting rule
File size:	496'128 bytes
First seen:	2026-02-01 01:35:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'854 x Amadey, 290 x Smoke Loader)
ssdeep	6144:Kdy+bnr+xp0yN90QEWIqHq7Lfdt3LmrXiQQRcrbtfc6sN+8UAsqFOqmu3Fe1uPx7:/MrVy904K7rbhDc+6uhb8+DJXiQVN
Threatray	1 similar samples on MalwareBazaar
TLSH	T173B4020BE5E89072DC65877054E701C31636FA902B589793778FED5A28B32B0B37627E
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Bitsight
Tags:	Amadey dropped-by-gcleaner exe f LAB.file

Bitsight

url: http://195.178.136.38/service

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Details

Archives

an extracted Cabinet archive from the resources and SFX parameters

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/6dc16f71-444c-48da-8b4d-944c73aad132/

Malware family:

amadey

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-02-01 01:35:50 UTC

Tags:

amadey botnet stealer auto redline stealc vidar credentialflusher auto-reg neoreklami adware gcleaner loader auto-sch goproxy salatstealer rdp purecrypter kamasers udados api-base64 xor-url generic upx python ms-smartcard xmrig miner github pastebin

Link:

https://app.any.run/tasks/0bfce8bc-0810-4914-b672-bd717861719a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/51062/

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Win.Malware.Generic-10058845-0

Win.Malware.Xeu2gbl-10058901-0

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=697eae10d93e7233498c418a

Tags:

autorun emotet delphi mint

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context amadey amadey anti-vm base64 CAB cmd explorer fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc mikey netsh obfuscated packed packed packed rundll32 runonce schtasks sfx stealer vidar wmic

Link:

https://www.filescan.io/uploads/697eae05930564ff3c8147cc/reports/eacc48ba-4bab-402b-99b1-06bf037fe678/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-01-31T22:43:00Z UTC

Last seen:

2026-01-31T23:17:00Z UTC

Hits:

~10

Detections:

BSS:Trojan.Win32.Generic Trojan-Dropper.Win32.Agent.sb HEUR:Trojan-Downloader.Win32.Deyma.gen VHO:Trojan-PSW.Win32.Vidar.gen Trojan-PSW.Win32.Vidar.hev PDM:Trojan.Win32.Generic Trojan-Downloader.Win32.Deyma.sb Trojan-PSW.Vidar.HTTP.C&C Trojan-Downloader.Agent.TCP.C&C VHO:Trojan-Downloader.Win32.Convagent.gen Trojan-PSW.Lumma.HTTP.Download Trojan.Agentb.TCP.C&C BSS:Exploit.Win32.Generic Trojan-PSW.Win32.Vidar.d Trojan-Downloader.PsDownload.HTTP.C&C Trojan-Downloader.Agent.HTTP.C&C Trojan.Nymaim.HTTP.ServerRequest

Link:

https://opentip.kaspersky.com/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/400d9fcb-adf3-4eb4-aec7-0af73184b2cb

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/735af08a6a65e4efc3f6d2c70427c0e5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882/

Verdict:

Malicious

Threat:

Family.REDLINE

Link:

https://tip.neiki.dev/file/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2026-02-01 01:36:22 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cr22ho2oylljtmm7zslfy6qthxjfh6q6pkq25uplqvqegfptjcba._file

Verdict:

malicious

Label(s):

amadey

Similar samples:

error

Amadey

Result

Malware family:

vidar

Score:

10/10

Tags:

family:amadey family:vidar botnet:fbf543 collection defense_evasion discovery execution installer miner persistence pyinstaller spyware stealer trojan upx

Link:

https://tria.ge/reports/260201-b1brgafw4a/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

GoLang User-Agent

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Modifies registry key

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Inno Setup is an open-source installation builder for Windows applications.

Browser Information Discovery

Detects Pyinstaller

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Enumerates processes with tasklist

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Checks BIOS information in registry

Checks computer location settings

Creates new service(s)

Cryptocurrency Miner

Disables service(s)

Executes dropped EXE

Identifies Wine through registry keys

Indirect Command Execution

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Amadey

Amadey family

Detects Amadey x86-bit Payload

Detects Vidar Stealer

Vidar

Vidar family

Malware Config

C2 Extraction:

http://94.154.35.25

Unpacked files

SH256 hash:

1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882

MD5 hash:

735af08a6a65e4efc3f6d2c70427c0e5

SHA1 hash:

30aa9a92e8be58fdbf3b077d3fd3a6c8cbe890a0

Link:

https://www.unpac.me/results/8e37ed5f-f4d7-46f3-9a9e-f30dd5e88f4f/

SH256 hash:

f99c69a781b8cbb1139e308a173ac8092f72159a1dd32a37d55ab763d8f2d94d

MD5 hash:

b9c27da0758728c0001fa48de182175c

SHA1 hash:

37cf68129996649245274402a20945be9ab8cab2

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/8e37ed5f-f4d7-46f3-9a9e-f30dd5e88f4f/

Parent samples :

043411ec48a610695668589c877e96b333b1a7b2ba07304ab0776339edf61cc1
b65e358f50489d16259f50dc37d3f997990b699980798aa5430877603717ec5d
1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882
e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649
63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71
df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663
cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

SH256 hash:

1a47995b128b736b51d5d24c6f7efdeb33b8c53bfb39819e5bef0ed9f54dff02

MD5 hash:

17e86ed9ea9a6987f128efd3b55aefd0

SHA1 hash:

93b08a57e57614e90f16b24ff7cd2cde45d0152f

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/8e37ed5f-f4d7-46f3-9a9e-f30dd5e88f4f/

Parent samples :

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1475a3bb4ec2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

exe 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882

(this sample)

Dropped by

Gcleaner

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/51062/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample