MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 17

Intelligence 17 IOCs YARA 19 File information Comments

SHA256 hash:	9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7
SHA3-384 hash:	f907dc4dc4f2a5d8b24f5463fc022f6cd7b1073975f14e67870d5b5d193cecc790a117254166dd0d868f1a480b7cc851
SHA1 hash:	e30cd103beddb8bdb5ea87123723df8f207e7e43
MD5 hash:	69bd7524ed5fc7e50e1d8cd9a3b66f36
humanhash:	april-massachusetts-edward-florida
File name:	9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7
Download:	download sample
Signature	Amadey Create hunting rule
File size:	5'068'800 bytes
First seen:	2025-12-08 14:47:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep	98304:lBlAWS8IVAlm0k+u5N9GxxPgDk04BII31jr/ROMjuLLHiVT:LlAWv6N+49GxxPgDk04BL31jr/gSuLLk
Threatray	3'191 similar samples on MalwareBazaar
TLSH	T1533633A2A14CCCCAEE02D730AB5E606D3877256B2FB15D14BF6771367E14E868F1061E
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	Amadey exe

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

troldesh

ID:

File name:

4363463463464363463463463.exe

Verdict:

Malicious activity

Analysis date:

2025-10-08 00:08:23 UTC

Tags:

loader auto rhadamanthys stealer lumma telegram hausbomber anti-evasion github ransomware troldesh shade quasar generic stealc meterpreter xworm rat python auto-sch-xml evasion discord aurotun amadey xred backdoor unlocker-eject tool redline remote gh0st sainbox metasploit wannacry botnet rdpwrap rmm-tool phishing arch-exec gcleaner netsupport arcstealer purecrypter pastebin pythonstealer rustystealer rdp delphi

Link:

https://app.any.run/tasks/8fa290ef-d9bc-42fb-be9d-f821e7051441

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/43175/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ed742097a16d00a8d9a3c1

Tags:

dropper virus sage

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-17T15:22:00Z UTC

Last seen:

2025-10-07T13:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/89a69bbe-bc03-4e56-badb-e40167c0ee50

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.37 Win 32 Exe x86

Link:

https://app.malva.re/file/69bd7524ed5fc7e50e1d8cd9a3b66f36

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7/

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2025-09-17 21:31:36 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 23 (82.61%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=t7yo2im4k35zl5mooopj53haqjqg3kcvnkp4z42eico25lrkj23q._file

Verdict:

malicious

Label(s):

amadey

admintool_nircmd

admintool_nsudo

unc_loader_051

lummastealer

Amadey

0d95e636a7e133f2d04f8cdcc0e7e46628a3172f6f5e8e3f2ceea014c911fd4c

Amadey

1db211a355727107916e15b30f1f91bf0630b6bf8d3c0e9ea88a76d8ff3c9ed1

Amadey

2f994afc548d528e56a029cf4481d56a3459d438b46ec38403a977bc7d70dced

Amadey

3ba3ef4cc21a08817b7e7dae3a46f13bd596025ecd2d983a2203e4bd3eeb14c7

Amadey

59a9f58e089576e053f87c747158987d3d6fd80bfd58ce3b82cfa3d3b4966228

Amadey

+ 3'181 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:amadey family:vidar botnet:fbf543 defense_evasion discovery execution installer persistence stealer trojan upx

Link:

https://tria.ge/reports/251208-r6mnxsdk5w/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Modifies registry key

Modifies data under HKEY_USERS

Kills process with taskkill

Inno Setup is an open-source installation builder for Windows applications.

System Location Discovery: System Language Discovery

Program crash

Enumerates physical storage devices

Launches sc.exe

Drops file in Windows directory

Enumerates processes with tasklist

Suspicious use of SetThreadContext

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Stops running service(s)

Executes dropped EXE

Disables service(s)

Creates new service(s)

Checks computer location settings

Sets service image path in registry

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Vidar family

Vidar

Detects Vidar Stealer

Detects Amadey x86-bit Payload

Amadey family

Amadey

Malware Config

C2 Extraction:

http://94.154.35.25

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/59fb7b99-616f-4565-8b34-f3352e86d209

Unpacked files

SH256 hash:

9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7

MD5 hash:

69bd7524ed5fc7e50e1d8cd9a3b66f36

SHA1 hash:

e30cd103beddb8bdb5ea87123723df8f207e7e43

Link:

https://www.unpac.me/results/d13ae794-869f-4515-b2d4-17debeb9146c/

SH256 hash:

d35ce2baf358abfeaea919c2d3532267eaa6f12359fcacdce89e0292aef7fd79

MD5 hash:

c766678bacc8c842246272c4db731139

SHA1 hash:

2cdd5a15f50ac0ec01bdaa09b11635e1e9a9d760

Link:

https://www.unpac.me/results/d13ae794-869f-4515-b2d4-17debeb9146c/

SH256 hash:

4757f636d9e7e4576fb1c999b3e12e29c6cce7e477016fb7d77b7ebe50255f05

MD5 hash:

9273d0cf3ad23234e09e40f6f3c251b1

SHA1 hash:

fc55b8cc2133acb88dd899f06fe53875a663d638

Detections:

Amadey

Link:

https://www.unpac.me/results/d13ae794-869f-4515-b2d4-17debeb9146c/

SH256 hash:

88c16be93a885a10ae057cc6a86d4897c3a36c0caa5861388d20546272ced010

MD5 hash:

c308143eab572b53197e150323d16a78

SHA1 hash:

b8621d8d4d98b42762a08eebbfd021191ad8a97b

Link:

https://www.unpac.me/results/d13ae794-869f-4515-b2d4-17debeb9146c/

SH256 hash:

c39c4466f622b7320076076ea3eb13fa0f784b9b097dff46d802f905fc39d851

MD5 hash:

a7993e5a520b17fec65435fb4838a08f

SHA1 hash:

18fe6286473a03735e7b701d4bfaf61ad35da7ad

Link:

https://www.unpac.me/results/d13ae794-869f-4515-b2d4-17debeb9146c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9ff0ed219c56fb95f58e739e9eece082606da8556a9fccf344409daeae2a4eb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	win_lumma_generic Create hunting rule
Author:	dubfib

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/