MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 20


Intelligence 20 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2
SHA3-384 hash: 15911451f444039b70b175aecb5c68a74f9623acc948d406ca64167c2540ae115d0a556954bfdd598750256c0b266e92
SHA1 hash: 756a250bbdf81fcf2472d702a4d6b1cccd1ea41f
MD5 hash: 2171e410a79bc9ae23d385af211dabd4
humanhash: cola-fanta-fix-paris
File name:lol.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:5'296'640 bytes
First seen:2025-10-01 13:57:21 UTC
Last seen:2025-10-07 20:35:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ff906d5ae0d3218e00c9d571874cb7f8 (3 x Rhadamanthys, 1 x CoinMiner, 1 x Amadey)
ssdeep 49152:zL4Go7UXQntCMUVDQmE4LZftWb76CTep/MueBOP42EM+MHyXTcAeKbFVtS3zf:P4QAtjJ0ptgWTe7VAHKbF+zf
TLSH T10A36B083FA930043FBE345B06F29C9A1D8191BE77A2929D680188184D4FDDAFD9B3577
TrID 49.9% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.6% (.EXE) OS/2 Executable (generic) (2029/13)
9.5% (.EXE) Generic Win/DOS Executable (2002/3)
9.4% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter burger
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
104
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ripple Spoofer.exe
Verdict:
Malicious activity
Analysis date:
2025-10-01 13:54:40 UTC
Tags:
anti-evasion lumma rhadamanthys stealer autoit loader
Link:
https://app.any.run/tasks/538e84b4-4f0e-449a-a930-a522a8771540

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Amadey
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29772/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dd33837d643f33eab91cf3
Tags:
phishing autorun cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
DNS request
Connection attempt to an infection source
Connection attempt
Sending an HTTP POST request
Query of malicious DNS domain
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68dd339074e5a289899c5693/reports/44081815-a64a-4569-bc48-c58b486bf27e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-01T12:08:00Z UTC
Last seen:
2025-10-03T09:56:00Z UTC
Hits:
~10
Detections:
Trojan-Downloader.Win32.Deyma.sb UDS:DangerousObject.Multi.Generic
Link:
https://opentip.kaspersky.com/8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2/results?tab=lookup
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b92e455-711d-4b47-98ba-601bb7703cc7
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1787385
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2/
Verdict:
Malicious
Threat:
Family.AMADEY
Link:
https://tip.neiki.dev/file/8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2
Threat name:
Win32.Trojan.RadThief
Create hunting rule
Status:
Malicious
First seen:
2025-10-01 13:58:32 UTC
File Type:
PE (Exe)
AV detection:
32 of 38 (84.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qu45m6uhn2txm2n4c6qc53tkrjjmwvzclsnjb4x4fggh32m3hdba._file
Verdict:
malicious
Label(s):
amadey
Create hunting rule
Similar samples:
error
Amadey
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey botnet:1b2025 discovery trojan
Link:
https://tria.ge/reports/251001-q92ftazk12/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Amadey
Amadey family
Detects Amadey x86-bit Payload
Malware Config
C2 Extraction:
http://microsoft-telemetry.cc
http://xboxtelemetry-defender.cc
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f15a8fc8-482c-4e4d-90dc-77e4a4a22acb
Unpacked files
SH256 hash:
8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2
MD5 hash:
2171e410a79bc9ae23d385af211dabd4
SHA1 hash:
756a250bbdf81fcf2472d702a4d6b1cccd1ea41f
Link:
https://www.unpac.me/results/98587585-4146-4307-9e3c-a5e47f820cd9/
SH256 hash:
34e90a4e853a403550528858a409602e5471ad999748a7f53912730896476ebc
MD5 hash:
eb59600b981a6b29914b81ad3f3fe4df
SHA1 hash:
5349fe43328e2cf00474e0d56a73d239d3aadb1f
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/98587585-4146-4307-9e3c-a5e47f820cd9/
Parent samples :
2399672c48839929e4dd63c5107d1751128f74b30ea82dca873a8c27ed591c13
27c2134b7774f29e657f881ca9177fe6e93a9b6e03fda4579168b9099c0005a8
8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8539d67a876e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly, YungBinary
Description:Amadey Payload
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MAL_Win_Amadey_Jun25
Create hunting rule
Author:0x0d4y
Description:This rule detects intrinsic patterns of Amadey version 5.34
Reference:https://0x0d4y.blog/amadey-targeted-analysis/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:win_amadey_062025
Create hunting rule
Author:0x0d4y
Description:This rule detects intrinsic patterns of Amadey version 5.34.
Reference:https://0x0d4y.blog/amadey-targeted-analysis/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

CoinMiner

Executable exe d20e658f8f6f0756f41d8b00b89b54d8175d5b60caee1717182a79576e4bb69d

Amadey

Executable exe 8539d67a876ea77669bc17a02eee6a8a52cb57225c9a90f2fc298c7de99b38c2

(this sample)

  
Dropped by
SHA256 d20e658f8f6f0756f41d8b00b89b54d8175d5b60caee1717182a79576e4bb69d
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/29772/
  
Dropped by
MD5 61a3db50f513174c3d0536094fe346f0

Comments