MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 17

Intelligence 17 IOCs YARA 8 File information Comments

SHA256 hash:	2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc
SHA3-384 hash:	adf71d4ed264a603d51a11422da45b0401715e35ac61be5e46654dc5ea57e6f84648ec83dfccaa1e3fce561f1813297d
SHA1 hash:	673dc5eb41d04c3c887e3fb32ac5e4e101da02b4
MD5 hash:	a78a99804a98a3ba01ed01f4857c9d0d
humanhash:	mississippi-leopard-sweet-mockingbird
File name:	file
Download:	download sample
Signature	Amadey Create hunting rule
File size:	1'282'048 bytes
First seen:	2026-03-27 01:00:55 UTC
Last seen:	2026-03-27 03:02:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3f175edea93fa7a76a78004d12de2235 (21 x Amadey)
ssdeep	24576:mrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRbTOnW:mkHmiyCkhh2Bamituw+UBR
Threatray	36 similar samples on MalwareBazaar
TLSH	T168557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	1456c6 Amadey cred64.dll dropped-by-amadey exe plugin

Bitsight

url: http://89.45.6.18/oPvjr94jfe/Plugins/cred64.dll

Intelligence

File Origin

# of uploads :

# of downloads :

203

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Amadey

Details

Amadey

a c2 url and a version

Link:

https://research.acce.ciphertechsolutions.com/results/975c1b70-3409-48e3-8aed-36e05c744c16/

Malware family:

amadey

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-03-27 01:02:53 UTC

Tags:

stealer amadey botnet

Link:

https://app.any.run/tasks/0e3973e3-02fb-4cd9-ab5e-d28df46aaf94

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

Win.Keylogger.Zusy-10017136-0

YARA.SEKOIA_Loader_Amadey_Stealer_Plugin.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c5d6f1aacb4c376b147992

Tags:

stealer virus lien sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey anti-debug base64 crypto fingerprint hacktool keylogger lolbin makecab microsoft_visual_cc netsh stealer zusy

Link:

https://www.filescan.io/uploads/69c5d6e92346b9da57a9ddcd/reports/aba00a49-fa4a-4093-b82d-9eab235cc67e/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc

Verdict:

Malicious

File Type:

dll x64

First seen:

2026-03-20T10:37:00Z UTC

Last seen:

2026-03-27T07:08:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb VHO:Trojan-PSW.Win32.Stealer.gen VHO:Trojan-PSW.Win32.Convagent.gen

Link:

https://opentip.kaspersky.com/2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6b0f4abd-2b7d-4df9-8d7a-40303ecd0cf8

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc/

Verdict:

Malicious

Threat:

Family.AMADEY

Link:

https://tip.neiki.dev/file/2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc

Threat name:

Win64.Trojan.Amadey

Status:

Malicious

First seen:

2026-03-20 16:09:28 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fzamiqdsto2dutc6rotlzqd3ibwft26nid2pzdfevnaf64q4gloa._file

Verdict:

malicious

Label(s):

amadey

Amadey

7970e1539ed52f372b48787b8f60f5dc2e497a242907bdb8e9dd4a435686574c

Amadey

7f8113026f9365964132e98dde901dbbf294caba44a20992a9a1e734c990ac06

Amadey

8a214a1d5c7767e5018737f6961886f2bb621f12af5dff34d3de145ae2b103c9

Amadey

a0b453b054513023dc3a5460eb813c70717776e7a26ee89c8ad97ef281084bf1

Amadey

def0aaaa225924555a66d6ea802578461f7117dc1b759c6aa765c457bda7fb8a

Amadey

error

Amadey

+ 26 additional samples on MalwareBazaar

Result

Malware family:

amadey

Score:

10/10

Tags:

family:amadey botnet:1456c6 credential_access discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/260327-bdhlhagy4r/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Wi-Fi Discovery

Reads WinSCP keys stored on the system

Reads local data of messenger clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Badlisted process makes network request

Malware Config

C2 Extraction:

http://89.45.6.18

Unpacked files

SH256 hash:

2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc

MD5 hash:

a78a99804a98a3ba01ed01f4857c9d0d

SHA1 hash:

673dc5eb41d04c3c887e3fb32ac5e4e101da02b4

Link:

https://www.unpac.me/results/cf1e50d1-1b51-439c-9517-2c4b5c5a9d4c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2e40c440729bb43a4c5e8ba6bcc07b406c59ebcd40f4fc8ca4ab405f721c32dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	StealerDLL_Amadey Create hunting rule
Author:	NDA0E
Description:	Detects Amadey's Stealer DLL

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.