MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 16

Intelligence 16 IOCs YARA 14 File information Comments

SHA256 hash:	3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a
SHA3-384 hash:	43f303ee63a1513f990c173be2973af8b5b5bccc75b38785e3c36397e231b3e1ab9e1689de7d6ae02699d6fe96fdd589
SHA1 hash:	e8b27a9b284b6d5d7a792692d01c8b70ea8cafb4
MD5 hash:	fe415557ba8004349316645525c793a9
humanhash:	blue-beryllium-mountain-butter
File name:	3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a.exe
Download:	download sample
Signature	Amadey Create hunting rule
File size:	180'736 bytes
First seen:	2026-08-24 13:42:21 UTC
Last seen:	2026-10-20 05:59:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'691 x Formbook, 12'401 x SnakeKeylogger)
ssdeep	3072:R8btTfnelD+aL26Ogi52ztMX/kipPTq/jLfuDX+gUy1i4woUDQut/T0j8z4OFOto:R8b++arOgi5Q6X/u/nfuDX+Uo4woUDQn
TLSH	T1C204024363FC4238F0B56978A5BB9901BA76FFD0AC7DC45DA099700D49B7A74C5B2321
TrID	55.8% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 20.6% (.EXE) UPX compressed Win32 Executable (27066/9/6) 5.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.9% (.EXE) Win64 Executable (generic) (6522/11/2) 3.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	whack_sh
Tags:	Amadey exe whack.sh

Intelligence

File Origin

# of uploads :

580

# of downloads :

217

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

bomb.exe

Verdict:

Malicious activity

Analysis date:

2026-08-24 00:56:55 UTC

Tags:

ip-check phorpiex botnet screenconnect remote stealer stealc discord github phishing possible-phishing fakesite loader amadey generic pikabot evasion rat xmrig miner stego payload qrcode connectwise rmm-tool auto tool nemucod powershell susp-powershell rdp backdoor webshell inj3ctor3 jomangy upx xworm maskgramstealer advancedinstaller apt blindeagle credentialflusher quasar njrat bladabindi asyncrat coinminer remusstealer reverseloader autoit netreactor kimsuky

Link:

https://app.any.run/tasks/b40c12e4-02e0-42ad-9cd5-5b820e95f7e9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/82650/

Detection(s):

SecuriteInfo.com.W32.Agent.CLM.tr.28781.20236.UNOFFICIAL

YARA.CAPE_Amadey.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac67dedc221a7c0810730e3

Tags:

dropper delphi virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Enabling the 'hidden' option for recently created files

Creating a file in the %temp% directory

Running batch commands

Launching a process

Deleting a recently created file

Creating a process from a recently created file

Сreating synchronization primitives

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP GET request

Creating a process with a hidden window

DNS request

Sending a custom TCP request

Creating a window

Searching for synchronization primitives

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Connection attempt to an infection source

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Setting a single autorun event

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Enabling autorun

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context amadey cmd downloader lolbin obfuscated packed packed packer schtasks

Link:

https://www.filescan.io/uploads/6a8c4a701937f0781e29711f/reports/109f71ee-1a5f-4d13-bb33-a9980506bf8f/overview

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-08T03:08:00Z UTC

Last seen:

2026-08-25T23:27:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b4510b18-a4aa-4c73-aff3-6b3457721142

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/fe415557ba8004349316645525c793a9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a/

Threat name:

ByteCode-MSIL.Trojan.Amadey

Status:

Malicious

First seen:

2026-05-08 08:23:33 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 23 (82.61%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=h4cqcn5z6ganzcbzrhdxc4rhz3p6wtds5p7muqkvpc4mlkdv7jva._file

Verdict:

malicious

Label(s):

ADMINTOOL_NirCmd

Amadey

Vidar

Link:

https://reports.threatray.com/c124ac18-a6fc-417d-9252-3e61ab5eff7f

Result

Malware family:

amadey

Score:

10/10

Tags:

family:amadey discovery execution installer persistence trojan upx

Link:

https://tria.ge/reports/260824-q1bh2ayejd/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

UPX packed file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

Detects Amadey x86-bit Payload

Family: Amadey

Malware Config

C2 Extraction:

http://196.251.107.248

Unpacked files

SH256 hash:

3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a

MD5 hash:

fe415557ba8004349316645525c793a9

SHA1 hash:

e8b27a9b284b6d5d7a792692d01c8b70ea8cafb4

Link:

https://www.unpac.me/results/2e9b1498-e8bf-4559-8b44-efb8b8fd525d/

SH256 hash:

db74500245168523b4f5465dea1478e3c8ca854282f4283ef62fca49a114e18f

MD5 hash:

848e6a5bfc98d0d7c90791aba4fc34ec

SHA1 hash:

ec6be5dd311a35e45d8534636f2488ed221f3766

Link:

https://www.unpac.me/results/2e9b1498-e8bf-4559-8b44-efb8b8fd525d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Amadey Create hunting rule
Author:	kevoreilly, YungBinary
Description:	Amadey Payload

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.