MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8a42c891c1d9e6e85b75a9d29a81185fab32f4cbf78a83348e2cac8e2fc3db8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Amadey
Vendor detections: 17
| SHA256 hash: | 8a42c891c1d9e6e85b75a9d29a81185fab32f4cbf78a83348e2cac8e2fc3db8a |
|---|---|
| SHA3-384 hash: | 88a7e0da0aab57c2641feb7dbace3eaeb8980a971f8813c13511aeab276370040b2f49ddc9234e664916720c7fac08c9 |
| SHA1 hash: | d93e3d4a4ccc1eca31c35c6a2f45c41779ae218d |
| MD5 hash: | 06800a0ad773925d485e7a539997ad57 |
| humanhash: | may-arkansas-juliet-eleven |
| File name: | 8a42c891c1d9e6e85b75a9d29a81185fab32f4cbf78a8.exe |
| Download: | download sample |
| Signature | Amadey |
| File size: | 1'164'800 bytes |
| First seen: | 2025-07-21 00:30:39 UTC |
| Last seen: | 2025-07-21 08:38:57 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6c74960f3a69d34ad9ccc1b30862115c (1 x Amadey) |
| ssdeep | 24576:saidf+Lr/Z/lJa1c7OyS8oAsPkBoslHyXCamWK78iE0w:sHd23Bi1AyZmWK78ew |
| Threatray | 5 similar samples on MalwareBazaar |
| TLSH | T15345CF07FA8908F3DB6B40344597962AEE36B8114796CBCF57B04E5A5E333E09E39352 |
| TrID | 32.2% (.EXE) Win64 Executable (generic) (10522/11/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | Amadey exe |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://66.63.187.111/Waaagh/index.php | https://threatfox.abuse.ch/ioc/1558782/ |
Intelligence
File Origin
# of uploads :
3
# of downloads :
45
Origin country :
NLVendor Threat Intelligence
Malware family:
amadey
ID:
1
File name:
index.exe
Verdict:
Malicious activity
Analysis date:
2025-07-21 00:16:51 UTC
Tags:
amadey botnet stealer loader telegram lumma rdp aurotun shellrunner stealc autoit auto generic ousaban redline gcleaner hijackloader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
94.9%
Tags:
shellcode emotet virus remo
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Сreating synchronization primitives
Connecting to a non-recommended domain
Connection attempt
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
anti-debug anti-vm expired-cert fingerprint microsoft_visual_cc packed
Verdict:
Malicious
Labled as:
Zusy.Generic
Malware family:
LogMeIn
Verdict:
Suspicious
Result
Threat name:
Amadey
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Behaviour
Behavior Graph:
Score:
97%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) Win 64 Exe x64
Verdict:
Malicious
Threat:
Trojan.Win32.Shellcode
Threat name:
Win64.Trojan.Amadey
Status:
Malicious
First seen:
2025-07-20 19:17:21 UTC
File Type:
PE+ (Exe)
Extracted files:
22
AV detection:
14 of 24 (58.33%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
amadey
donut_injector
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:donutloader family:lumma family:xmrig defense_evasion discovery execution loader miner persistence spyware stealer trojan upx
Behaviour
Modifies data under HKEY_USERS
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Launches sc.exe
Enumerates processes with tasklist
Suspicious use of SetThreadContext
UPX packed file
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Creates new service(s)
Stops running service(s)
XMRig Miner payload
Detects DonutLoader
DonutLoader
Donutloader family
Lumma Stealer, LummaC
Lumma family
Suspicious use of NtCreateUserProcessOtherParentProcess
Xmrig family
xmrig
Malware Config
C2 Extraction:
https://t.me/CheatZone4U
https://pandhnyk.top/zids
https://tunenrnc.top/xodz
https://permwgp.xyz/xlak
https://recopcwr.top/atki
https://ultracpj.xyz/apgk
https://vegemuoe.top/xauy
https://seruneqy.live/akiz
https://siniavzv.life/xajz
https://strujqwn.xyz/xkkd
https://pandhnyk.top/zids
https://tunenrnc.top/xodz
https://permwgp.xyz/xlak
https://recopcwr.top/atki
https://ultracpj.xyz/apgk
https://vegemuoe.top/xauy
https://seruneqy.live/akiz
https://siniavzv.life/xajz
https://strujqwn.xyz/xkkd
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
8a42c891c1d9e6e85b75a9d29a81185fab32f4cbf78a83348e2cac8e2fc3db8a
MD5 hash:
06800a0ad773925d485e7a539997ad57
SHA1 hash:
d93e3d4a4ccc1eca31c35c6a2f45c41779ae218d
SH256 hash:
796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
MD5 hash:
f1b14f71252de9ac763dbfbfbfc8c2dc
SHA1 hash:
dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
SH256 hash:
ecbf11f0240f365625fd2343012fa06eadf1359c2693939c844eaba60d6046b8
MD5 hash:
26c6f4770ea55de462bccfc55c923ab5
SHA1 hash:
59658e2e8a118ea53ce164e363edbbf09bd7a449
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | command_and_control |
|---|---|
| Author: | CD_R0M_ |
| Description: | This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | ProgramLanguage_Rust |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Rust programming language |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessA KERNEL32.dll::CloseHandle |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateDirectoryA KERNEL32.dll::CreateFileW KERNEL32.dll::FindFirstFileW KERNEL32.dll::GetTempPathA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.