MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments

SHA256 hash:	aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9
SHA3-384 hash:	2a76a13155f09152d2242541e97af945aed9bcdcc7235ad6a9b828ac4aa2fff06cd870d78b003a0fd71b6b5f8078de23
SHA1 hash:	9c7b63d628998e087d3568d56b4c2d5ffce58d58
MD5 hash:	e7efa3f9770e0e28833b4482c0651a53
humanhash:	three-low-blue-robin
File name:	file
Download:	download sample
Signature	Amadey Create hunting rule
File size:	126'976 bytes
First seen:	2026-01-27 17:10:25 UTC
Last seen:	2026-03-25 14:29:35 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	fdb088ba51afbf555d7a0f495212d8f1 (22 x Amadey)
ssdeep	3072:FYZ27UeZm+wr7CImzEyv/Y4Z3SNqLfYYOpf:qo7JfuCIsEyfZ3jYnpf
Threatray	207 similar samples on MalwareBazaar
TLSH	T148C33A213496C031D66D56BE18A8ABF487BD6910DFB00DD77B840D7B9E242C2EE34D7A
TrID	32.2% (.EXE) Win64 Executable (generic) (10522/11/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	Amadey clip.dll dll dropped-by-amadey fbf543 plugin

Bitsight

url: http://94.154.35.25/di9ku38f/Plugins/clip.dll

Intelligence

File Origin

# of uploads :

543

# of downloads :

321

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Amadey

Details

Amadey

a c2 url and a version

Link:

https://research.acce.ciphertechsolutions.com/results/7e9226ce-0dd2-43d0-89fc-2de6bc6c45bd/

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/50420/

Detection(s):

Win.Malware.Zusy-10015683-0

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6978f1b3bec9764f452f6014

Tags:

clipbanker virus zusy

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey amadey base64 clipbanker microsoft_visual_cc zusy

Link:

https://www.filescan.io/uploads/6978f19c4156786ccbdac524/reports/c1623e55-2965-4bf9-8a68-ec58eed8b979/overview

Verdict:

Malicious

Labled as:

Trojan/Amadey

Link:

https://www.hybrid-analysis.com/sample/aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9

Verdict:

Malicious

File Type:

dll x32

First seen:

2025-07-23T10:29:00Z UTC

Last seen:

2026-01-27T08:11:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/36f3c83b-f59b-4290-ad24-a956f45bf6df

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9/

Verdict:

Malicious

Threat:

Trojan-PSW.Nymaim.HTTP

Link:

https://tip.neiki.dev/file/aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2025-07-23 20:16:36 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vi65otzzhepm5jw4efw5zpcgn3g6ry43yfroqdsouq2fevsisc4q._file

Verdict:

malicious

Label(s):

amadey

Amadey

994d115922a3ce8324114199fb7d06d7c8276779f83523b66b8c05505b81376e

Amadey

a06f2283f9db8322c1fb8603553f3dcf6592d41072707cabd4934ffa64c4c1aa

Amadey

b946960a201ceb50e3b9b7585c7cc7c57adf228c0358772f3870d7ddd53d35bf

Amadey

d2886d86ef67a3550a4aadcf623aa785fddcd3af754b3035229647f186005b1c

Amadey

f6eefcfcac942d900a5fa1528a9edd2bfc2ec31ac953556c39051099bfac195f

Amadey

+ 197 additional samples on MalwareBazaar

Result

Malware family:

amadey

Score:

10/10

Tags:

family:amadey botnet:fbf543 discovery

Link:

https://tria.ge/reports/260127-vp7vbag18a/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Malware Config

C2 Extraction:

http://94.154.35.25

Unpacked files

SH256 hash:

aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9

MD5 hash:

e7efa3f9770e0e28833b4482c0651a53

SHA1 hash:

9c7b63d628998e087d3568d56b4c2d5ffce58d58

Link:

https://www.unpac.me/results/32bb2c97-7474-4e77-a695-980b82c0ebca/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aa3dd74f39391ecea6dc216ddcbc466ecde8e39bc162e80e4ea43452564890b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Amadey Create hunting rule
Author:	kevoreilly, YungBinary
Description:	Amadey Payload

Rule name:	ClipperDLL_Amadey Create hunting rule
Author:	NDA0E
Description:	Detects Amadey's Clipper DLL

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com