MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
SHA3-384 hash: c5c6d9db120460d7f0216d7bacd4129b3786b0ae538fa945e6b0aa6bf95bd1b36da211bb1b7c1b1019492c09fd708e43
SHA1 hash: 20b9bc5e9aa95ec43c227c8926b96a5272bc3a0e
MD5 hash: 095c8d13b25f395f8df9f3a79066b1a3
humanhash: alpha-nineteen-victor-earth
File name:file
Download: download sample
Signature Amadey
Create hunting rule
File size:4'729'344 bytes
First seen:2025-09-29 04:04:39 UTC
Last seen:2025-09-29 04:04:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 98304:pQpcMcHiR7+UaIIP/BzBstEk0iaURANcjuqwG59D:cOHiRavZ6Kk0inRAijk
Threatray 1'535 similar samples on MalwareBazaar
TLSH T1ED26336B6D0CCC90E2E94835F6A915FD4973C635222E72648B2E04196CACBFFFD8452D
TrID 52.9% (.EXE) Win32 Executable (generic) (4504/4/1)
23.5% (.EXE) Generic Win/DOS Executable (2002/3)
23.5% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:Amadey dropped-by-amadey exe


Avatar
Bitsight
url: http://178.16.55.189/am_def/random.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-09-29 04:08:07 UTC
Tags:
amadey botnet stealer auto redline rdp unlocker-eject tool stealc loader themida arch-exec auto-reg vidar auto-startup phishing generic
Link:
https://app.any.run/tasks/e997058e-1d13-4143-a231-1f398a9888b5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29350/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68da059a73afd01b31e0ec38
Tags:
vmdetect autorun emotet spoof
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a file in the Windows directory
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Creating a service
Launching a service
Restart of the analyzed sample
Creating a file in the Windows subdirectories
Searching for synchronization primitives
Running batch commands
Launching the default Windows debugger (dwwin.exe)
Creating a window
Searching for the window
Creating a file
Enabling autorun for a service
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68da0597c564c8e81d099d10/reports/6e66a645-d876-4178-be60-d61b0a861a55/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-29T02:15:00Z UTC
Last seen:
2025-09-29T02:15:00Z UTC
Hits:
~10
Detections:
VHO:Trojan-Banker.MSIL.BitStealer.gen Trojan.Nymaim.HTTP.ServerRequest Trojan.BAT.Agent.cot HEUR:Trojan-Downloader.Win32.Generic BSS:Exploit.Win32.Generic HEUR:Trojan.MSIL.Agent.gen VHO:Backdoor.Win32.Androm.gen Trojan-PSW.Lumma.HTTP.Download VHO:Trojan-Downloader.Win32.Convagent.gen BSS:Trojan.Win32.Generic Trojan.Agentb.TCP.C&C Trojan-Downloader.Win32.Deyma.sb HEUR:Trojan-Downloader.Win32.Deyma.gen HEUR:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/20f9a1fb-dff9-48dc-8400-a49fa1c8df0a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/095c8d13b25f395f8df9f3a79066b1a3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062/
Verdict:
Malicious
Threat:
Family.AMADEY
Link:
https://tip.neiki.dev/file/55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2025-09-29 04:05:46 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
31 of 38 (81.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kx2lihhq64ydv62s2r3ff4xyz4lqovweanlua65nu6ao27b6obra._file
Verdict:
malicious
Label(s):
amadey
Create hunting rule
Similar samples:
01cb5a170ccb486184841f7adf57026bf18fdd25d71824ebe40161256a3f1f9b
Amadey
19b43280e8756f0955cb02a66789c5c4111f24366e384e89e913f5cd3639be9e
Amadey
1b4a27465a2fc0ec65d36590d7a4c7b94dabb9152e2a8fa9e6aa83a9d7e340b0
Amadey
55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
Amadey
7d4020ddb279ccac816a8c931dd6435f8cfeca3e8a88d96c4a830f9c963e80a3
Amadey
b3a49ed46957bea9b6fa46b6f67445bc6e8885ae200c811a4b038d939b369aac
Amadey
b42256a0e9632bda5338a23bbbb8a750f204b343d6f561d3412baef66077739f
Amadey
error
Amadey
+ 1'525 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:darkvision family:deerstealer family:gcleaner family:hijackloader family:stealc family:vidar botnet:022b40a3515838306f88566b5c3425afn botnet:39fb888fe504972eb6fa660d36407b35n botnet:8989c668d82d9bbaf27f5a308ae1e16cn botnet:fbf543 botnet:tr1pernn campaign:ty5r0t backdoor bootkit collection defense_evasion discovery execution loader persistence privilege_escalation ransomware rat revoked_codesign spyware stealer themida trojan upx
Link:
https://tria.ge/reports/250929-envwcsvvfy/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies registry key
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
Enumerates processes with tasklist
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Enumerates connected drives
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Checks computer location settings
ConnectWise ScreenConnect remote access tool
Creates new service(s)
Disables service(s)
Drops startup file
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Identifies Wine through registry keys
Impair Defenses: Safe Mode Boot
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Stops running service(s)
Themida packer
Binary is signed using a ConnectWise certificate revoked for key compromise.
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Drops file in Drivers directory
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Amadey family
DarkVision Rat
Darkvision family
DeerStealer
Deerstealer family
Detects Amadey x86-bit Payload
Detects DeerStealer
Detects HijackLoader (aka IDAT Loader)
GCleaner
Gcleaner family
HijackLoader
Hijackloader family
Stealc
Stealc family
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Vidar family
Malware Config
C2 Extraction:
http://94.154.35.25
185.156.73.98
45.91.200.135
31.57.38.89
https://steamcommunity.com/profiles/76561198783900411
https://telegram.me/rif0lm
http://178.16.54.175
https://steamcommunity.com/profiles/76561198785836552
https://telegram.me/nc1anasy
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/173678ca-bc27-453a-af57-d6daa5777984
Unpacked files
SH256 hash:
55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
MD5 hash:
095c8d13b25f395f8df9f3a79066b1a3
SHA1 hash:
20b9bc5e9aa95ec43c227c8926b96a5272bc3a0e
Link:
https://www.unpac.me/results/4b7ca171-44dc-4d2e-b4c9-5ea4f8096d41/
SH256 hash:
66b4eaa75dc43f7e909089e441e372bdf5eb50eea2da8bc21e7598227c0ca030
MD5 hash:
1cc405d420c04cf9286e8feb31190546
SHA1 hash:
edabeaa069f1958e67af596bf02b7143db540050
Link:
https://www.unpac.me/results/4b7ca171-44dc-4d2e-b4c9-5ea4f8096d41/
SH256 hash:
fa9446c7c48b7c6787fc9136fad36e0719c0633de73a3b2e7ffc4b32f63e602e
MD5 hash:
eec30f9aec5f702b633b26f1e788addc
SHA1 hash:
835bd317e475cd8c2caf9af96ec35b4d73553968
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/4b7ca171-44dc-4d2e-b4c9-5ea4f8096d41/
SH256 hash:
ab068e4702413e67e47e30a114fa3870cc3b1d19b6162d383857afbf4dda5ce9
MD5 hash:
41d80c6152268839ba9f2a492ced3037
SHA1 hash:
4cd07ddc405fd72cbb612767ab7bfafc73a3eab3
Link:
https://www.unpac.me/results/4b7ca171-44dc-4d2e-b4c9-5ea4f8096d41/
SH256 hash:
c39c4466f622b7320076076ea3eb13fa0f784b9b097dff46d802f905fc39d851
MD5 hash:
a7993e5a520b17fec65435fb4838a08f
SHA1 hash:
18fe6286473a03735e7b701d4bfaf61ad35da7ad
Link:
https://www.unpac.me/results/4b7ca171-44dc-4d2e-b4c9-5ea4f8096d41/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/55f4b41cf0f7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/29350/

Comments