🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 11


Intelligence 11 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db
SHA3-384 hash: 9ecb85a2fd8ba9cb9e3cd8c6956b1b20679f1b1d8695463a0a3e6ca1fb810248b47c9c72e4940b522617b2b77fa5f62b
SHA1 hash: 345c76d32032e542ae09c8777cca0e6a1fa43583
MD5 hash: 870e153448c554a0a50cfe5aeb07a4f6
humanhash: may-jersey-queen-floor
File name:python37.dll
Download: download sample
Signature Amadey
Create hunting rule
File size:14'649'856 bytes
First seen:2026-07-09 18:43:56 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ee5f7a2ae4f305dde2aefb30837ab931 (1 x Amadey)
ssdeep 196608:t6UvZxDUBpih8jDp6ZXVxnDJ9i4xYkI1rc6/t3ExWMFGVwJBMRCQB:t6UHDUBUNdVx9pYr/IoVYECQB
TLSH T1E6E6E022FB409035F8EE00F663FA47BA1D798D18572190C386E538D59B326D33A7A75B
TrID 51.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
20.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.1% (.EXE) Win64 Executable (generic) (6522/11/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 983626a2b84cb1d1 (1 x Amadey)
Reporter abuse_ch
Tags:Amadey de-pumped dll exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74093/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.21968987.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4fec1ea900f0e9eb6b5f00
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 crypto datper evasive fingerprint loader microsoft_visual_cc packed reconnaissance stealer
Link:
https://www.filescan.io/uploads/6a4fec14005fe4de0c17f494/reports/e6015d9e-6184-4045-b4c2-a947be5241ae/overview
Verdict:
Malicious
Labled as:
Infostealer/ACRStealer
Link:
https://www.hybrid-analysis.com/sample/267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db
Verdict:
Malicious
File Type:
dll x32
First seen:
2026-07-09T15:52:00Z UTC
Last seen:
2026-07-10T19:27:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Dllhijack.sb HEUR:Trojan-Dropper.Win32.Cython.gen
Link:
https://opentip.kaspersky.com/267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db/results?tab=lookup
Malware family:
Python
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d768a415-ded7-4353-b828-1006e02c8cf3
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1940204
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1940204 Sample: python37.dll Startdate: 09/07/2026 Architecture: WINDOWS Score: 56 36 mr-b01.tm-azurefd.net 2->36 38 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->38 42 Antivirus / Scanner detection for submitted sample 2->42 44 Multi AV Scanner detection for submitted file 2->44 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        15 rundll32.exe 9->15         started        17 17 other processes 9->17 process6 19 rundll32.exe 11->19         started        21 WerFault.exe 3 16 13->21         started        24 WerFault.exe 16 15->24         started        26 WerFault.exe 16 17->26         started        28 WerFault.exe 17->28         started        30 WerFault.exe 17->30         started        32 2 other processes 17->32 dnsIp7 34 WerFault.exe 22 16 19->34         started        40 mr-b01.tm-azurefd.net 150.171.109.73, 443, 49713, 49716 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 21->40 process8
Score:
31%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db/
Verdict:
Malicious
Threat:
Trojan.Win32.Dllhijack
Link:
https://tip.neiki.dev/file/267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-07-09 18:46:01 UTC
File Type:
PE (Dll)
Extracted files:
14
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ez7d2hojoghmth7mvuukh5hmeqia3cyofrqhaeujnapdtwc72pnq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/260709-xdsblaf13m/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db
MD5 hash:
870e153448c554a0a50cfe5aeb07a4f6
SHA1 hash:
345c76d32032e542ae09c8777cca0e6a1fa43583
Link:
https://www.unpac.me/results/8958a648-3000-4650-bafa-a8e95c581e8e/
SH256 hash:
27054bdabf9594d4daa85dd70b3c81892464565a9b04518c30000db18fb16ed5
MD5 hash:
b5a72f9719bf62738195571cd0f2ff0e
SHA1 hash:
73e1b97308de9969bc8e028978dc9d9378500603
Link:
https://www.unpac.me/results/8958a648-3000-4650-bafa-a8e95c581e8e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agent_BTZ
Create hunting rule
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FormhookB
Create hunting rule
Author:kevoreilly
Description:Formbook Anti-hook Bypass
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:win_amadey_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
Rule name:Win_FakeInstaller_PythonShellcodeLoader_Crepectl_2026
Create hunting rule
Author:SixHands
Description:Detects the analyzed fake installer sample using .key config, XOR key, and Python/fiber shellcode loader traits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

zip 7576f5a25608e6a2d4e632b7030857431f6747444ce1ad5986e045407f8bef6c

Amadey

DLL dll 267e3d1dc9718ec99fecad28a3f4ec24100d8b0e2c60701289681e39d85fd3db

(this sample)

  
Dropped by
MD5 807b4271a04bd6b3c2e03a560b6e2959
  
Dropped by
SHA256 7576f5a25608e6a2d4e632b7030857431f6747444ce1ad5986e045407f8bef6c
Cape
Cape
https://www.capesandbox.com/analysis/74093/

Comments