MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 19b43280e8756f0955cb02a66789c5c4111f24366e384e89e913f5cd3639be9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Amadey
Vendor detections: 17
| SHA256 hash: | 19b43280e8756f0955cb02a66789c5c4111f24366e384e89e913f5cd3639be9e |
|---|---|
| SHA3-384 hash: | 994ae208b40aaa9a7470823c83a99d31f9e8012a2ab699a29b00090b9359d43b5ba5b8825e6ba1a3740eddf793888a88 |
| SHA1 hash: | 2cb530011c244b5c474addf31e4a08f5f2d6c3d0 |
| MD5 hash: | 5613a45d6953cd6e0a923381946efb93 |
| humanhash: | two-stream-mississippi-victor |
| File name: | file |
| Download: | download sample |
| Signature | Amadey |
| File size: | 4'724'736 bytes |
| First seen: | 2025-09-28 04:05:18 UTC |
| Last seen: | 2025-09-28 04:10:00 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer) |
| ssdeep | 98304:UvQNNYbjK2qoxrRvSH4nuS6To9Rh14NkuXi37GUfRQsCx:R/EjxZRJuSJ12lXGGyqsCx |
| Threatray | 1'529 similar samples on MalwareBazaar |
| TLSH | T1442633E09D96DAA2C322B6FE1F1D02E546491C88D227EDA538342176FFCF10A6ED531D |
| TrID | 52.9% (.EXE) Win32 Executable (generic) (4504/4/1) 23.5% (.EXE) Generic Win/DOS Executable (2002/3) 23.5% (.EXE) DOS Executable Generic (2000/1) |
| Magika | pebin |
| Reporter |  Bitsight |
| Tags: | Amadey dropped-by-amadey exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
125
Origin country :
USVendor Threat Intelligence
Malware family:
amadey
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-09-28 04:08:23 UTC
Tags:
amadey botnet stealer auto redline unlocker-eject tool rdp arch-exec generic themida loader stealc vidar hijackloader auto-startup gcleaner screenconnect rmm-tool remote autoit lumma phishing auto-reg
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.9%
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a file in the Windows directory
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Creating a service
Launching a service
Restart of the analyzed sample
Creating a file in the Windows subdirectories
Searching for synchronization primitives
Running batch commands
Launching the default Windows debugger (dwwin.exe)
Creating a window
Searching for the window
Creating a file
Enabling autorun for a service
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm crypt obfuscated packed packed themidawinlicense unsafe xpack zusy
Verdict:
Malicious
Labled as:
Zusy.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-28T01:35:00Z UTC
Last seen:
2025-09-28T01:35:00Z UTC
Hits:
~10
Verdict:
Suspicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Threat name:
Win32.Trojan.Amadey
Status:
Suspicious
First seen:
2025-09-28 04:14:02 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 24 (87.50%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
admintool_nircmd
amadey
admintool_nsudo
unc_loader_051
Similar samples:
+ 1'519 additional samples on MalwareBazaar
Result
Malware family:
vidar
Score:
10/10
Tags:
family:amadey family:deerstealer family:hijackloader family:salatstealer family:stealc family:vidar botnet:366901f1a2eba9879151e77e0dd2f008n botnet:deadjake botnet:fbf543 backdoor bootkit defense_evasion discovery execution loader persistence privilege_escalation ransomware rat revoked_codesign spyware stealer themida trojan upx
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies registry key
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Views/modifies file attributes
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
Enumerates processes with tasklist
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
UPX packed file
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Enumerates connected drives
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Checks computer location settings
ConnectWise ScreenConnect remote access tool
Creates new service(s)
Disables service(s)
Drops startup file
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Identifies Wine through registry keys
Impair Defenses: Safe Mode Boot
Loads dropped DLL
Reads user/profile data of web browsers
Stops running service(s)
Themida packer
Binary is signed using a ConnectWise certificate revoked for key compromise.
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Drops file in Drivers directory
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Amadey family
DeerStealer
Deerstealer family
Detect SalatStealer payload
Detects Amadey x86-bit Payload
Detects DeerStealer
Detects HijackLoader (aka IDAT Loader)
HijackLoader
Hijackloader family
Salatstealer family
Stealc
Stealc family
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Vidar family
salatstealer
Malware Config
C2 Extraction:
http://94.154.35.25
https://steamcommunity.com/profiles/76561198783900411
https://telegram.me/rif0lm
http://178.16.54.175
https://steamcommunity.com/profiles/76561198783900411
https://telegram.me/rif0lm
http://178.16.54.175
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
19b43280e8756f0955cb02a66789c5c4111f24366e384e89e913f5cd3639be9e
MD5 hash:
5613a45d6953cd6e0a923381946efb93
SHA1 hash:
2cb530011c244b5c474addf31e4a08f5f2d6c3d0
SH256 hash:
39c8636a37c64a6104b627e680dd3e4277bc5c3d9aae9acfb7caa48acd169853
MD5 hash:
c477c20aa4b2ddc95a2a6de88c254fc4
SHA1 hash:
7e1cb08d6a7e06dc7666afa9837c5a74b52a3fec
Detections:
Amadey
SH256 hash:
88351fee8d9a98b8429c49246b9d44a7bb27df1a65bd117aa63fba9a1778b8bc
MD5 hash:
a3ef90c5e5b03a289bbce98a3fb08ca2
SHA1 hash:
bab975e7ea1013344300bc9e362a947ec25133d2
SH256 hash:
7715ccea1ef8c455bfd6257c1051b9ce621c62885378d7bc15f3b37870037e08
MD5 hash:
5ba283bf51979e9a4d6f0392aeaf00f6
SHA1 hash:
2abc56e4f049ff080dd1d6eb55eeaf2c2d6df607
SH256 hash:
c39c4466f622b7320076076ea3eb13fa0f784b9b097dff46d802f905fc39d851
MD5 hash:
a7993e5a520b17fec65435fb4838a08f
SHA1 hash:
18fe6286473a03735e7b701d4bfaf61ad35da7ad
Malware family:
ScreenConnect
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_AllMal_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Dropped by
Amadey
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.