🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5
SHA3-384 hash: e51887dc3ccdee2c98a151ec4352c862be82f003720beafa7f19fab16b5f3301cef06f00b7d4b11370071dd9b0232707
SHA1 hash: dbe0861ef15875ef0f80e7dbf1eb1baca6b69bdb
MD5 hash: d9364eaf2a9bddb813bff9a1caba6d8f
humanhash: spaghetti-seven-whiskey-illinois
File name:d9364eaf2a9bddb813bff9a1caba6d8f.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:34'304 bytes
First seen:2025-12-25 12:32:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8068d82e2993f851a750aba84fc72ca9 (3 x Amadey)
ssdeep 768:anNlAP5jHPTjiBwEYkg3baAezJ3Va0H6LgYjWqWsl1/heIs:+45jvKBxKq3/HqWsl185
TLSH T1B6F25BAE07D401FCC9AAC5B5D8B63A03D3B1B0475EB1568F0171C5DA9F02AD3AD2D789
TrID 38.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:Amadey exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
TinyLoader
Details
TinyLoader
xor decoded strings including cryptocurrency addresses and a c2 url
Link:
https://research.acce.ciphertechsolutions.com/results/cf783065-2b01-4c4e-94d0-83da05d90fae/
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-12-24 22:46:35 UTC
Tags:
auto-reg stealc stealer auto-sch python crypto-regex svcstealer
Link:
https://app.any.run/tasks/ced7cdf6-e58a-4d07-92f1-35064bc07ee9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46040/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694d2f0801c7b4a8fe55953c
Tags:
ransomware trojan extens
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
amadey clipbanker clipper exploit obfuscated unsafe
Link:
https://www.filescan.io/uploads/694d2f07e126b9ff43910a2b/reports/f65526ad-cf68-4915-bf55-41e095d4fa3e/overview
Verdict:
Malicious
Labled as:
Trojan.Loader.Marte.6.Generic
Link:
https://www.hybrid-analysis.com/sample/c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-24T20:53:00Z UTC
Last seen:
2025-12-27T09:09:00Z UTC
Hits:
~100
Detections:
Trojan-Banker.Win32.ClipBanker.agph Trojan.Snojan.HTTP.C&C PDM:Trojan.Win32.Generic Trojan-Banker.Win32.ClipBanker.sb VHO:Trojan-Banker.Win32.Convagent.gen VHO:Trojan-Banker.Win32.ClipBanker.gen Trojan-Banker.Win32.ClipBanker.agoz
Link:
https://opentip.kaspersky.com/c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5/results?tab=lookup
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ab112f6-3d8e-4b46-a472-347cf85be4da
Result
Threat name:
Clipboard Hijacker, Diamotrix Clipper
Create hunting rule
Detection:
malicious
Classification:
bank.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1839313
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks if browser processes are running
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Found API chain indicative of debugger detection
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected Diamotrix Clipper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1839313 Sample: 1aNkv8t92P.exe Startdate: 25/12/2025 Architecture: WINDOWS Score: 100 87 Suricata IDS alerts for network traffic 2->87 89 Malicious sample detected (through community Yara rule) 2->89 91 Antivirus detection for URL or domain 2->91 93 6 other signatures 2->93 9 1aNkv8t92P.exe 9 2->9         started        14 ZKHFLWSR.exe 1 2->14         started        16 ZKHFLWSR.exe 2->16         started        18 3 other processes 2->18 process3 dnsIp4 81 62.60.226.159, 49720, 80 ASLINE-AS-APASLINELIMITEDHK Iran (ISLAMIC Republic Of) 9->81 83 178.16.53.7, 49719, 80 DUSNET-ASDE Germany 9->83 85 196.251.107.61, 49715, 49716, 49718 ANGANI-ASKE Seychelles 9->85 77 C:\Users\user\AppData\Local\...\ZKHFLWSR.exe, PE32+ 9->77 dropped 79 C:\Users\user\AppData\Local\...BNAYIMB.exe, PE32+ 9->79 dropped 121 Found evasive API chain (may stop execution after checking mutex) 9->121 123 Injects code into the Windows Explorer (explorer.exe) 9->123 125 Writes to foreign memory regions 9->125 127 Found direct / indirect Syscall (likely to bypass EDR) 9->127 20 EBNAYIMB.exe 52 9->20         started        24 explorer.exe 69 2 9->24 injected 26 ZKHFLWSR.exe 1 1 9->26         started        129 Allocates memory in foreign processes 14->129 131 Creates a thread in another existing process (thread injection) 14->131 133 Injects a PE file into a foreign processes 14->133 28 schtasks.exe 1 14->28         started        30 schtasks.exe 16->30         started        32 schtasks.exe 18->32         started        34 schtasks.exe 18->34         started        36 schtasks.exe 18->36         started        file5 signatures6 process7 file8 69 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 20->69 dropped 71 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 20->71 dropped 73 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 20->73 dropped 75 47 other malicious files 20->75 dropped 95 Multi AV Scanner detection for dropped file 20->95 38 EBNAYIMB.exe 20->38         started        97 Found API chain indicative of debugger detection 24->97 99 Checks if browser processes are running 24->99 101 Contains functionality to compare user and computer (likely to detect sandboxes) 24->101 40 ZKHFLWSR.exe 24->40         started        43 ZKHFLWSR.exe 24->43         started        103 Antivirus detection for dropped file 26->103 105 Injects code into the Windows Explorer (explorer.exe) 26->105 107 Uses schtasks.exe or at.exe to add and modify task schedules 26->107 109 4 other signatures 26->109 55 2 other processes 26->55 45 conhost.exe 28->45         started        47 conhost.exe 30->47         started        49 conhost.exe 32->49         started        51 conhost.exe 34->51         started        53 conhost.exe 36->53         started        signatures9 process10 signatures11 111 Injects code into the Windows Explorer (explorer.exe) 40->111 113 Writes to foreign memory regions 40->113 115 Allocates memory in foreign processes 40->115 57 schtasks.exe 40->57         started        117 Creates a thread in another existing process (thread injection) 43->117 119 Injects a PE file into a foreign processes 43->119 59 schtasks.exe 43->59         started        61 conhost.exe 55->61         started        63 conhost.exe 55->63         started        process12 process13 65 conhost.exe 57->65         started        67 conhost.exe 59->67         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/d9364eaf2a9bddb813bff9a1caba6d8f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5/
Verdict:
Malicious
Threat:
Family.AMADEY
Link:
https://tip.neiki.dev/file/c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5
Threat name:
Win64.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2025-12-25 06:39:33 UTC
File Type:
PE+ (Exe)
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yvcitkjn6fsmsppd5itwjzb7n27obchxfeyywqnjprmm35zrigsq._file
Verdict:
malicious
Label(s):
unc_loader_073
Create hunting rule
Similar samples:
error
Amadey
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution persistence pyinstaller
Link:
https://tria.ge/reports/251225-pyn6nsbm51/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Detects Pyinstaller
Enumerates physical storage devices
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b7131b70-02be-47fe-9185-b8d8e812d415
Unpacked files
SH256 hash:
c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5
MD5 hash:
d9364eaf2a9bddb813bff9a1caba6d8f
SHA1 hash:
dbe0861ef15875ef0f80e7dbf1eb1baca6b69bdb
Detections:
win_sdbbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/5d2522f4-fede-407e-ba9d-2eca3d43b2ea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.93
Link:
https://yomi.yoroi.company/submissions/c54489a92df164c93de3ea2764e43f6ebee088f729318b41a97c58cdf73141a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:win_sdbbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.sdbbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46040/

Comments