MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 18


Intelligence 18 IOCs 1 YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825
SHA3-384 hash: a8f4975fe08843afb01bb721463ef572da8d8c082ee95388c9da3bff89b0ed245c8265af7aae3fe51a6dda05bb3f80d3
SHA1 hash: c197a6249917b02ce4669f1848969b55d87132d8
MD5 hash: 0c347c00021e023a84e9641a794b5c1c
humanhash: hotel-pizza-minnesota-triple
File name:9109ffd0652d8b2bcc5870e62a44865a923133646341c.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:1'858'680 bytes
First seen:2025-08-31 23:35:37 UTC
Last seen:2025-09-01 08:17:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c2a6fbef41572f4c9ce8acb5a63cde7 (2 x Expiro, 1 x Nefilim, 1 x StealthWorker)
ssdeep 24576:51hNZDjvG7f5C3cSAFQG+CaQ2XAc4n+OW:51DZ/u7hYcSSd+CabQcH
Threatray 25 similar samples on MalwareBazaar
TLSH T1F8853C03BCA924ABDBBDED364A767110F672705A032177873A4D817EA716B943E3E314
TrID 48.6% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://77.90.153.62/cvdfnaFJBmC0/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://77.90.153.62/cvdfnaFJBmC0/index.php https://threatfox.abuse.ch/ioc/1578835/

Intelligence

File Origin
# of uploads :
3
# of downloads :
118
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
USDT_Flash-Software.v2.0.rat.download
Verdict:
Malicious activity
Analysis date:
2025-08-29 22:47:02 UTC
Tags:
amadey botnet stealer xtinyloader loader anti-evasion lumma rdp python qrcode crypto-regex clipper diamotrix
Link:
https://app.any.run/tasks/64a625df-da41-498f-9087-677251e9777a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Amadey
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24406/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader48.63838.18965.5331.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b4dc4eeb163e0ec183bc75
Tags:
dropper emotet extens sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Creating a file
Connection attempt to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-08-29T16:25:00Z UTC
Last seen:
2025-08-29T16:25:00Z UTC
Hits:
~100
Detections:
Trojan-Downloader.Win32.Deyma.sb Trojan-Downloader.Win32.Deyma.lby VHO:Trojan-PSW.Win32.Lumma.gen Trojan-PSW.Lumma.HTTP.Download Trojan.Agentb.TCP.C&C BSS:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/762403bd-eb5c-4308-89f0-bfb1515a2fa0
Result
Threat name:
Amadey
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1768581
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Drops PE files to the document folder of the user
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Writes to foreign memory regions
Yara detected Amadey
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1768581 Sample: 9109ffd0652d8b2bcc5870e62a4... Startdate: 01/09/2025 Architecture: WINDOWS Score: 100 41 Suricata IDS alerts for network traffic 2->41 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 4 other signatures 2->47 7 9109ffd0652d8b2bcc5870e62a44865a923133646341c.exe 1 2->7         started        11 9109ffd0652d8b2bcc5870e62a44865a923133646341c.exe 2->11         started        13 9109ffd0652d8b2bcc5870e62a44865a923133646341c.exe 2->13         started        process3 file4 29 9109ffd0652d8b2bcc...5a923133646341c.exe, PE32+ 7->29 dropped 49 Drops PE files to the document folder of the user 7->49 51 Contains functionality to start a terminal service 7->51 53 Writes to foreign memory regions 7->53 15 CredentialUIBroker.exe 12 7->15         started        19 cmd.exe 1 7->19         started        55 Multi AV Scanner detection for dropped file 11->55 57 Allocates memory in foreign processes 11->57 59 Injects a PE file into a foreign processes 11->59 21 CredentialUIBroker.exe 11->21         started        23 CredentialUIBroker.exe 13->23         started        signatures5 process6 dnsIp7 31 77.90.153.62, 49727, 49731, 49734 RAPIDNET-DEHaunstetterStr19DE Germany 15->31 33 176.46.152.47, 49729, 49730, 49733 ESTPAKEE Iran (ISLAMIC Republic Of) 15->33 35 178.16.53.7, 49728, 49732, 49735 DUSNET-ASDE Germany 15->35 37 Contains functionality to start a terminal service 15->37 39 Contains functionality to inject code into remote processes 15->39 25 conhost.exe 19->25         started        27 reg.exe 1 1 19->27         started        signatures8 process9
Score:
77%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/0c347c00021e023a84e9641a794b5c1c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825/
Verdict:
Malicious
Threat:
Family.AMADEY
Link:
https://tip.neiki.dev/file/9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825
Threat name:
Win64.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2025-08-29 23:20:00 UTC
File Type:
PE+ (Exe)
Extracted files:
11
AV detection:
15 of 24 (62.50%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=see77udffwfsxtcyodtcureglkjdcm3emna4dhgqoqlvxrvslasq._file
Verdict:
malicious
Label(s):
amadey
Create hunting rule
Similar samples:
2db0f0084f8f30c9c507016b041871ce5d54f77f26688a200ab6f38a4d40b195
Amadey
6931da3b18f6ec11042ec36f39f00ff9e565e775147e33105655666e473badd5
Amadey
9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825
Amadey
939f93221f0e62fdcfef66b228fd18c549e4a0b047ace3c1b84969ce03dc396a
Amadey
cb9bd04a140f01165856fc726e03801c3d757a63bfda2b8b4638d2bfb726d089
Amadey
e21fc5566a26632476b82fe2803a09a0a65c61c50ffa9a04745210c8a0041ed3
Amadey
error
Amadey
+ 15 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:lumma family:stealc botnet:30x08x2025 botnet:e3db0b discovery persistence pyinstaller spyware stealer trojan
Link:
https://tria.ge/reports/250831-3lphkatwft/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Detects Pyinstaller
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Amadey
Amadey family
Lumma Stealer, LummaC
Lumma family
Stealc
Stealc family
Malware Config
C2 Extraction:
http://176.46.152.47
http://178.16.53.7
http://77.90.153.62
http://176.46.152.46
https://t.me/quincyplayer6
https://solacdf.top/xiot
https://mastwin.in/qsaz
https://noggs.ru/yopd
https://georgej.ru/plnb
https://oneflof.ru/tids
https://epitherd.ru/zadw
https://backab.ru/lkdo
https://eigwos.ru/wqex
https://kimmenkiz.ru/zldw
Verdict:
Malicious
Tags:
Amadey
YARA:
n/a
Link:
https://app.threat.zone/submission/448cc51a-6a8e-4f92-a0cf-a6639f43e51f
Unpacked files
SH256 hash:
9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825
MD5 hash:
0c347c00021e023a84e9641a794b5c1c
SHA1 hash:
c197a6249917b02ce4669f1848969b55d87132d8
Link:
https://www.unpac.me/results/0f383f06-2f01-4bd7-8585-db7d7fee8168/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9109ffd0652d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe 9109ffd0652d8b2bcc5870e62a44865a923133646341c19cd074175bc6b25825

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/24406/
  
URLhaus
https://urlhaus.abuse.ch/url/3615069/
  
Delivery method
Distributed via web download

Comments