MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
SHA3-384 hash: 572e18dc9a87396c960df4ebd7704b39766bd5fc19724fbb429491baf1503fd2fd20c10ebec35e2cc224800cef762cb6
SHA1 hash: c6e0031d4673d38dc7320f9113449673fbf83df8
MD5 hash: 58404d80c2e398d9546bf497ee6def13
humanhash: venus-salami-indigo-island
File name:21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
Download: download sample
Signature Amadey
Create hunting rule
File size:3'758'592 bytes
First seen:2025-07-31 11:53:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba60903a7ff57920867ef58a822b934f (2 x RedLineStealer, 2 x Amadey)
ssdeep 98304:g9ZArlbr/HaF99/YmtUeQ+qMzllNiBn1PY:OebzH69wmtUewMzllQn1P
Threatray 807 similar samples on MalwareBazaar
TLSH T13E06E2111709223FFF26F23F8B103654396E5A2E2DC5C1DBA3C8D196BAB396118F654E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter JAMESWT_WT
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
Verdict:
Malicious activity
Analysis date:
2025-07-31 12:41:05 UTC
Tags:
auto-reg stealer metastealer redline auto amadey botnet rdp
Link:
https://app.any.run/tasks/f57a443b-3832-49f1-8766-9d8ad1dad1fa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18048/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688b59ce0b4775fb2133f23d
Tags:
clipbanker redline emotet nemty
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Creating a window
Enabling the 'hidden' option for recently created files
Сreating synchronization primitives
Reading critical registry keys
Creating a file in the %AppData% directory
Connection attempt
Sending an HTTP POST request
Searching for synchronization primitives
Moving a recently created file
Launching a process
Loading a suspicious library
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Connection attempt to an infection source
Enabling autorun by creating a file
Forced shutdown of a browser
Verdict:
Malicious
Labled as:
Dropper.Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b635d993-ef74-4ff5-8267-7e6c375e8561
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/58404d80c2e398d9546bf497ee6def13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-07-31 00:54:05 UTC
File Type:
PE (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehjt7erzy4buts2daqsir3hzrktzzqawnyecpsdguf5rjh6wfwvq._file
Verdict:
malicious
Label(s):
redlinestealer
Create hunting rule
amadey
Create hunting rule
Similar samples:
1e7c2f76cda9a87962bdf277253c135ecf40c0e7cefe782eeb7d0128e55b1aa8
Amadey
720da27621335893eb8b2bf8350f213e6bf559359e6f9071822f027d812a2a55
Amadey
8e5e311c0af982943d5e7c6ba8d4dc5436b083f7144e84ecb0981f0010a47126
Amadey
994d115922a3ce8324114199fb7d06d7c8276779f83523b66b8c05505b81376e
Amadey
bbbd287a99f521d93784ed8294acddc658b9962c1f2138719e07ee8787f1f666
Amadey
error
Amadey
fc3a6888e328252a9686649f50cd46c9940be7b8f11f441c9acb30fed227e36e
Amadey
+ 797 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:redline botnet:jajaja discovery execution infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/250731-n25r6atyaw/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Command and Scripting Interpreter: PowerShell
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
Amadey
Amadey family
RedLine
RedLine payload
Redline family
Malware Config
C2 Extraction:
176.46.152.46:1911
Verdict:
Malicious
Tags:
Redline c2 Stealer MetaStealer
YARA:
n/a
Link:
https://app.threat.zone/submission/44e559e1-a88e-469d-baba-008fb6b7aa4b
Unpacked files
SH256 hash:
21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
MD5 hash:
58404d80c2e398d9546bf497ee6def13
SHA1 hash:
c6e0031d4673d38dc7320f9113449673fbf83df8
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
03aa48e8f40b06d5a6487ab465d63f763bae24bb71127a466df1c9d8bcafcfbf
MD5 hash:
bf9a089c52281db636ae4cafa5ccc8b0
SHA1 hash:
50305d3bf3acc6190450f4e8c63ca64cdf9f065b
Detections:
SUSP_XORed_Mozilla
Create hunting rule
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
77c74162e2363372b637154e5a87e01f34cc460606121883b03342b4611b93bf
MD5 hash:
0971d809fad17af4e589841bd031884f
SHA1 hash:
baab0c73dcc650200736f725ab616fee30d428a7
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
47f23ed1dac6eea3e1b8297300ffdb08456c9a42d2ac62c4aa32ae40970c3537
MD5 hash:
a78cbc4b1ac6753f0560ce2f7d2c5136
SHA1 hash:
85eee16458d5e8cff6a42c7b9d49e5c6ed0bb5cb
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
MD5 hash:
4ff75f505fddcc6a9ae62216446205d9
SHA1 hash:
efe32d504ce72f32e92dcf01aa2752b04d81a342
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2
MD5 hash:
0ee914c6f0bb93996c75941e1ad629c6
SHA1 hash:
12e2cb05506ee3e82046c41510f39a258a5e5549
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
74990b7b3cdb9c650ed31da724962d682c19d4f6aaf374eaeb45271c70c3da6a
MD5 hash:
8a80e42126fbaab7cb25f3930fd9f468
SHA1 hash:
b0b20805c2e841c36e75abaf4d6ab58e7dfcc778
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
SH256 hash:
994d115922a3ce8324114199fb7d06d7c8276779f83523b66b8c05505b81376e
MD5 hash:
27263a945a112e57aba4e978d89cbf4f
SHA1 hash:
f27dcc81c7ca62455d15526fd77138a77a7bf8a5
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/58a117fb-a656-4458-8417-e9597adc5883/
Parent samples :
bbbd287a99f521d93784ed8294acddc658b9962c1f2138719e07ee8787f1f666
8e5e311c0af982943d5e7c6ba8d4dc5436b083f7144e84ecb0981f0010a47126
1e7c2f76cda9a87962bdf277253c135ecf40c0e7cefe782eeb7d0128e55b1aa8
19c1a5da57d92f9068293c6443fbc5c0ae1261b3a796d1cb6d5abfc34661776d
b479f9035cc7f9d479f64dc47af55f32330a2c3d9eb592d1e1f45b7893a3f0c1
60a14371395270b14bf1390d77f5afbccc837fdf30f790a64578045fe78a4bc0
3c573e66b191de9b5f1dd3ec278533a6bba4dd68d6f44735168e0e6075ed00e5
21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab
13bdd724d62c42ea1cc551b06b94626dfbcd07c30830363d3d0ec212feea4860
6a66a4adae504bbbc1645ff0009a3ebd860e0b64762f95f6d9f8567b227c276e
8e1f84225e541eb8ac2067983d9c5d373fe8c5f9f72bda414823b0f4cd63c945
1002fc4c644e879e1f70a75c373151ddddcb41b2619a8e90f64e1fec8086e565
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/21d33f9239c7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21d33f9239c70349cb43042488ecf98aa79cc0166e0827c866a17b149fd62dab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/18048/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextA
ADVAPI32.dll::CryptGenRandom

Comments