MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 45523c4b45cce9252d51f1489660ce3c3b21ab1ab5a136f717f13a0eae0fc11b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Fuery
Vendor detections: 16
| SHA256 hash: | 45523c4b45cce9252d51f1489660ce3c3b21ab1ab5a136f717f13a0eae0fc11b |
|---|---|
| SHA3-384 hash: | 87b7c462c43194dff6dfcac6b9ad5f39187a468b4a3efb6ffe3992d1221332b4b9d279bfa217cb3a209583bd841e6e69 |
| SHA1 hash: | d1120dcc2d73135a6b40cee71af9e409fe6e0e60 |
| MD5 hash: | 1a041e3ab7523d2fb852c94acf8a4fe8 |
| humanhash: | charlie-september-low-oven |
| File name: | file |
| Download: | download sample |
| Signature | Fuery |
| File size: | 624'640 bytes |
| First seen: | 2025-10-09 04:03:08 UTC |
| Last seen: | 2025-10-13 04:09:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:VHA7ys1gez3KILxEO0CX1E/LtfA2EmoqKUEDatox/UiyL31I8uz4WEC7:VHAmaz3TLxE1U1E5fdEsKf5ULr1I8s4w |
| Threatray | 2'242 similar samples on MalwareBazaar |
| TLSH | T1BCD4228A2DAEDC07C9E21F311AF2C27426F4DCADA510D3A75FDA2EDF70768584501359 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  Bitsight |
| Tags: | dropped-by-amadey exe Fuery |
Intelligence
File Origin
# of uploads :
23
# of downloads :
65
Origin country :
USVendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
0_c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45.exe
Verdict:
Malicious activity
Analysis date:
2025-10-08 16:52:45 UTC
Tags:
auto redline stealer amadey botnet rdp gcleaner loader inno installer delphi darkvision remote rmm-tool netsupport arcstealer phishing rat anti-evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
92.5%
Tags:
phishing delphi spam
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Loading a suspicious library
Sending a custom TCP request
Connection attempt to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
explorer lolbin obfuscated packed packed packer_detected vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-08T09:19:00Z UTC
Last seen:
2025-10-11T02:26:00Z UTC
Hits:
~10000
Detections:
Trojan.Denes.UDP.C&C Trojan.MSIL.Inject.sb Backdoor.Win32.Agima.a Trojan-Ransom.Foreign.TCP.ServerRequest HEUR:Trojan-PSW.MSIL.Agensla.gen BSS:Trojan.Win32.Generic Trojan-Downloader.ZippyLoader.HTTP.C&C Backdoor.Agima.HTTP.C&C Trojan.MSIL.Taskun.sb Trojan.MSIL.Crypt.sb VHO:Trojan-PSW.MSIL.Convagent.gen Backdoor.Win32.Androm Trojan-Dropper.Win32.Injector.sb Trojan.Win32.Agent.sb Backdoor.Win32.Agima.sb Backdoor.Win32.Agima.b
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Verdict:
Malicious
Threat:
Backdoor.Win32.Agima
Threat name:
ByteCode-MSIL.Trojan.XWorm
Status:
Malicious
First seen:
2025-10-08 11:19:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
unc_loader_037
cryptinfinite
Similar samples:
+ 2'232 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Downloads MZ/PE file
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
45523c4b45cce9252d51f1489660ce3c3b21ab1ab5a136f717f13a0eae0fc11b
MD5 hash:
1a041e3ab7523d2fb852c94acf8a4fe8
SHA1 hash:
d1120dcc2d73135a6b40cee71af9e409fe6e0e60
SH256 hash:
6f6db5633fd026acbea80701ab558fbb29fa2a9508b152891a43454751039dd1
MD5 hash:
cbdc167a5f0da5305940da3c346fac02
SHA1 hash:
4224ea1e06a32399cc1e0a6aff756ebb5e984f52
SH256 hash:
be13fba038995f47789ce6e7bbd302509e2a4c9ee27036b4ad08acd7cfa9b122
MD5 hash:
f5654d649b372ca56c77a3b48611caba
SHA1 hash:
9d9c3c7e2792d5697c9fc80d44aea5fb9d7df9d5
SH256 hash:
8ab10a1e73b9b0ec8c2119bc4195e90792e5758c0a842dbc2b0d22effa217cf2
MD5 hash:
418214c6f5c7109b82afc3d1ebab5788
SHA1 hash:
ba27e5e894b0e6b270724a10bfb63e7c63b0bb60
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Dropped by
Amadey
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.