MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb
SHA3-384 hash: 2812232cc3647b074965e0bd4c1a294ddd045a174bdf3554aa0a66c0f6063ab2eb82c4a7ff980c3177a1362a67de659f
SHA1 hash: c9d699fbdd9628fdec1f0c3211d1c6ccd0ddaf4c
MD5 hash: 87e323117ace8cfc39c474d00b674895
humanhash: tango-leopard-comet-kitten
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:2'476'544 bytes
First seen:2025-12-27 15:16:12 UTC
Last seen:2025-12-28 06:39:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 74 x LummaStealer, 62 x Rhadamanthys)
ssdeep 49152:DmfLqdNE0PFkeuWhKOXpnIlwFPFPqhMUlrGHz4b6+svEE:DsGCJEpIls4Iz4Ic
Threatray 4'467 similar samples on MalwareBazaar
TLSH T199B5334697F6C40AE0F7A7799AF19A838671BC704736898F43D5913D1B226C0ED70B27
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:a Amadey dropped-by-gcleaner exe ONE.file


Avatar
Bitsight
url: http://194.38.20.224/service

Intelligence

File Origin
# of uploads :
20
# of downloads :
101
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Archives AutoIt
Details
Archives
an extracted Cabinet archive from the resources and SFX parameters
Link:
https://research.acce.ciphertechsolutions.com/results/d0ebef13-4189-449c-bc94-c571e5aea3ee/
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-12-27 15:18:09 UTC
Tags:
autoit auto-sch auto-startup loader amadey botnet stealer pureminer netreactor
Link:
https://app.any.run/tasks/91bfbca4-f290-4a32-b509-657653d2f90a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46226/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694ff841c157fc7de718ee32
Tags:
autorun autoit emotet
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit CAB expand installer installer installer-heuristic lolbin microsoft_visual_cc packed rundll32 runonce sc sfx
Link:
https://www.filescan.io/uploads/694ff841e126b9ff4393374b/reports/7a8779fb-92b4-4d8d-aa3c-3a14d5e9acd5/overview
Verdict:
Malicious
Labled as:
Malware_50.6
Link:
https://www.hybrid-analysis.com/sample/470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-27T12:31:00Z UTC
Last seen:
2025-12-29T05:10:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Agent.sb Backdoor.Win32.Agent.myxccr Backdoor.Agent.UDP.C&C Trojan-Dropper.Win32.Agent.sb
Link:
https://opentip.kaspersky.com/470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9403a2cd-7677-4d06-a820-b9b933eb2995
Score:
81%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
AutoIt CAB:COMPRESSION:LZX Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/87e323117ace8cfc39c474d00b674895
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb/
Verdict:
Malicious
Threat:
Family.AMADEY
Link:
https://tip.neiki.dev/file/470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb
Threat name:
Win64.Backdoor.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-27 15:17:19 UTC
File Type:
PE+ (Exe)
Extracted files:
28
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i4fet34k6ucesq56teminyj2lgzhdaxxx5svuhpjt5hcnls2klfq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
49e86f8f81cc8dad354e988d8d8baf2f79d45d7f7c542785ce37409df92bee6c
Amadey
9c269c9a794728320c75de37bc91430b449dda0fe538accb274f914b75588832
Amadey
d7db0d7dc30c23be46f202a33dcddea24f72754ef1ecf12b31680d85797e1b29
Amadey
e5105fd6fd8a6e79aeb583015741187e7eabe4ad667e8dacb4b8499d03816ff4
Amadey
ef69941b32be75da6500aa8a2c210bbc0470947c720a526f926f6a2c77141711
Amadey
error
Amadey
f1865f5bcb465ab20ce262b8313b50dcba98c503a406d2c88b7af6494a044b3e
Amadey
f35275a9cce5e94dd5eed7d07f9dadaff3ee727b6d87d968beb6895ecf60ccac
Amadey
+ 4'457 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251227-snkbhssqhn/
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1b8cd8e1-88ff-46b0-8ca4-991b1379a834
Unpacked files
SH256 hash:
470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb
MD5 hash:
87e323117ace8cfc39c474d00b674895
SHA1 hash:
c9d699fbdd9628fdec1f0c3211d1c6ccd0ddaf4c
Link:
https://www.unpac.me/results/10e4660e-9754-46d3-9b82-95454adc5230/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/470a49ef8af5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 470a49ef8af5044943be991886e13a59b27182f7bf655a1de99f4e26ae5a52cb

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/46226/

Comments