MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 12

Intelligence 12 IOCs YARA 9 File information Comments

SHA256 hash:	cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70
SHA3-384 hash:	8650dc8ca2caf9220f8f0ca8c1186f5b14277665a6c232d69c19949fc41e387689e1b96faee5dfae4e8d82472e912fb0
SHA1 hash:	44731f4e0941b686afdd9d4beb48ab9d19978173
MD5 hash:	df32d57edbf2f59a3b1ce50cb53a71f8
humanhash:	ink-angel-magazine-queen
File name:	file
Download:	download sample
Signature	Amadey Create hunting rule
File size:	1'102'336 bytes
First seen:	2026-05-15 08:47:02 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	a252cd53ebc44617e8418747345d10c1 (7 x Amadey)
ssdeep	24576:jLCrua2InCFeiwzFJEUoBmx43Bjbv0hzcJ313j:j+ruaRnC0iwzFg36oJF3j
Threatray	18 similar samples on MalwareBazaar
TLSH	T1DD359D16B941C071D49401706269BBF2593CAA35672145DBFBD02EB2ED305F3BE3AB2B
TrID	22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win64 Executable (generic) (6522/11/2) 17.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.7% (.EXE) Win32 Executable (generic) (4504/4/1) 7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	9d2ca3 Amadey cred.dll dll dropped-by-amadey plugin

Bitsight

url: http://91.92.242.236/oPvjr94jfe/Plugins/cred.dll

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Amadey

Details

Link:

https://research.acce.ciphertechsolutions.com/results/84060a3e-7664-495d-894d-c8c1e77acfb6/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/66007/

Detection(s):

Win.Keylogger.Zusy-10017136-0

YARA.SEKOIA_Loader_Amadey_Stealer_Plugin.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a06ddaf953bbcef1c907674

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70

Result

Gathering data

Verdict:

Unknown

File Type:

dll x32

First seen:

2026-05-09T04:13:00Z UTC

Last seen:

2026-05-09T04:26:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dc2cfdea-d8f4-4b03-bf02-d58028683d68

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/df32d57edbf2f59a3b1ce50cb53a71f8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70/

Verdict:

Malicious

Threat:

Family.AMADEY

Link:

https://tip.neiki.dev/file/cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2026-05-09 12:01:01 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zuam2f6d27viyo6stsyyscb3ppskg7zylvovwjeutngxp4i6drya._file

Verdict:

malicious

Label(s):

amadey

Amadey

b27ecd6a59c7d2471f7d407567d1b33068845ec89f5e0a76e18dc720cc69e80d

Amadey

c91e20371a7b292a5fd83e91d72d2042a5ae33aa45b14e5ffee21454b746ff5c

Amadey

e6d6e4467919d58c63962af6d28f307f41e21690fd62931135662f4661fb6fd5

Amadey

fc0622894170e86a3b783e6a97120d9fe519638347de8d8c64ae841fe29d8689

Amadey

+ 8 additional samples on MalwareBazaar

Gathering data

Unpacked files

SH256 hash:

cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70

MD5 hash:

df32d57edbf2f59a3b1ce50cb53a71f8

SHA1 hash:

44731f4e0941b686afdd9d4beb48ab9d19978173

Link:

https://www.unpac.me/results/b21f907b-00a4-4cde-b8df-a4b6e2206d8d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd00cd17c3d7ea8c3bd29cb189083b7be4a37f385d5d5b24949b4d77f11e1c70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	StealerDLL_Amadey Create hunting rule
Author:	NDA0E
Description:	Detects Amadey's Stealer DLL

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.