MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d
SHA3-384 hash: 36be071dbbe99c7b440931c53d1bb9f0064907a814408ee9264174aca224aabc393229e9de78ff8cb373d2b9ba5fa864
SHA1 hash: fcc05f199b62aea9896181196e3787251c254512
MD5 hash: 520a586fea709de1d19a75d424267709
humanhash: fruit-michigan-carpet-uranus
File name:file
Download: download sample
File size:3'365'251 bytes
First seen:2026-05-15 14:12:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3adc44bf55fd364769e7af499386b3b5
ssdeep 24576:2HwVqEpx95tQCRBRGIYkGhqK6toZ/8aLeCCChHvjyw3+Ec0xMk58UsU3AowTnZLQ:2HwMwx95tQqsLaohHvfKTnZLfT0udY
TLSH T1A1F5E8436ADB0DE6DED667B465D71335A738FD61CB2A1F2B9A08C2302D536C1AD1EB00
TrID 40.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.0% (.EXE) Win64 Executable (generic) (6522/11/2)
12.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Bitsight
Tags:54e64e dropped-by-amadey exe


Avatar
Bitsight
url: http://141.164.63.224:8000/download/client_pure.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d.exe
Verdict:
No threats detected
Analysis date:
2026-05-15 14:15:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f827c1e0-4de3-4f7a-a47a-749d16465f5b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/66040/
Detection(s):
YARA.MALPEDIA_Win_Sadbridge_Auto.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a072a0b46d6967b3d907ec1
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug mingw overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a072a05efbd399b39b12199/reports/16adb97f-7c6d-41c9-96f1-38391b081d4f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d
Verdict:
Adware
File Type:
exe x64
Detections:
RemoteAdmin.LiteManager.TCP.C&C
Link:
https://opentip.kaspersky.com/af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/da319c4d-5f98-434d-a34c-23e1624375bd
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/520a586fea709de1d19a75d424267709
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d/
Verdict:
Malicious
Threat:
RemoteAdmin.LiteManager.TCP
Link:
https://tip.neiki.dev/file/af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-15 14:13:31 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v57yjpu7bvzfwcvb637y3r5dyigd6jm6mce5tgw77duq6drcdaoq._file
Gathering data
Unpacked files
SH256 hash:
af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d
MD5 hash:
520a586fea709de1d19a75d424267709
SHA1 hash:
fcc05f199b62aea9896181196e3787251c254512
Detections:
win_sadbridge_auto
Create hunting rule
Link:
https://www.unpac.me/results/c66b2eaa-2463-48d3-9d9c-48da2a019595/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Rooter
Create hunting rule
Author:Seth Hardy
Description:Rooter
Rule name:RooterStrings
Create hunting rule
Author:Seth Hardy
Description:Rooter Identifying Strings
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:win_sadbridge_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.sadbridge.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe af7f84be9f0d725b0aa1f6ff8dc7a3c20c3f259e6089d99adff8e90f0e22181d

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/66040/

Comments