MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GoProxy

Vendor detections: 19

Intelligence 19 IOCs YARA 36 File information Comments

SHA256 hash:	cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5
SHA3-384 hash:	fef090adaca3102a77aaa527c2f35cf342e522202a62dee10aa85ef3d1d60d26a6affe287ac7d585faafdf9975cfb7f7
SHA1 hash:	814dbc9de8685175d30c7cde18a09b97bc2ed458
MD5 hash:	f9afa244d93f1123ad330b878418d050
humanhash:	hamper-kansas-berlin-tango
File name:	file
Download:	download sample
Signature	GoProxy Create hunting rule
File size:	496'128 bytes
First seen:	2026-02-02 14:23:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'854 x Amadey, 290 x Smoke Loader)
ssdeep	12288:4MrJy90wK7rbhDc+iIoeXLGG5nxDvektRBE:ByGvq+B3Xr5xDNtk
Threatray	1 similar samples on MalwareBazaar
TLSH	T187B4021BF9ED4071CCA4477015FA16C30A3ABA602B5497931B8FBD5B6D726B4B33122B
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-gcleaner exe f GoProxy LAB.file

Bitsight

url: http://195.178.136.38/service

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

amadey

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-02-02 14:24:37 UTC

Tags:

amadey botnet stealer auto redline stealc vidar loader goproxy auto-reg uac python purecrypter purelogs rdp api-base64 xor-url upx generic golang credentialflusher xmrig miner smtp pastebin gcleaner winring0-sys vuln-driver

Link:

https://app.any.run/tasks/05402c38-2fe7-44e5-8601-be55a023b0fc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/51230/

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Win.Malware.Generic-10058845-0

Win.Malware.Xeu2gbl-10058901-0

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6980b35ba9ffec4a96095340

Tags:

vmdetect emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file

Enabling the 'hidden' option for recently created files

Running batch commands

Launching a process

Сreating synchronization primitives

Unauthorized injection to a recently created process

Connection attempt to an infection source

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context amadey amadey anti-vm base64 CAB cmd explorer fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc netsh obfuscated packed packed packed rundll32 runonce schtasks sfx stealer wmic

Link:

https://www.filescan.io/uploads/6980b358930564ff3c83e360/reports/bec47e5d-d2d3-4d61-9720-e358425e7042/overview

Verdict:

Malicious

Labled as:

Crifi.Generic

Link:

https://www.hybrid-analysis.com/sample/cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

Verdict:

Malicious

File Type:

exe x32

Detections:

Trojan.Agentb.TCP.C&C BSS:Trojan.Win32.Generic HEUR:Trojan-Downloader.Win32.Deyma.gen VHO:Trojan-PSW.Win32.Vidar.gen Trojan.Nymaim.HTTP.ServerRequest Trojan-Downloader.Agent.HTTP.C&C VHO:Trojan-Downloader.Win32.Convagent.gen Trojan-PSW.Lumma.HTTP.Download BSS:Exploit.Win32.Generic PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Vidar.d Trojan-Dropper.Win32.Agent.sb Trojan-Downloader.Win32.Deyma.sb Trojan-PSW.Win32.Vidar.hma Trojan-Downloader.PsDownload.HTTP.C&C Trojan-PSW.Stealerc.TCP.C&C Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.HTTP.C&C Trojan-Downloader.Agent.TCP.C&C

Link:

https://opentip.kaspersky.com/cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4ae1d91a-c824-46b0-9a08-bf402d86fdf5

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/f9afa244d93f1123ad330b878418d050

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5/

Verdict:

Malicious

Threat:

Family.REDLINE

Link:

https://tip.neiki.dev/file/cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2026-02-02 14:23:27 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z7qlnrzpf2w2v3x6fb6rlltn7qp4iq2b363whrqoir64vgvwzxcq._file

Verdict:

malicious

Label(s):

amadey

Similar samples:

error

GoProxy

Result

Malware family:

vidar

Score:

10/10

Tags:

family:amadey family:donutloader family:quasar family:stealc family:vidar botnet:7720249373 botnet:fbf543 collection defense_evasion discovery execution loader miner persistence privilege_escalation pyinstaller spyware stealer trojan upx

Link:

https://tria.ge/reports/260202-rqadnabs8h/

Behaviour

Checks processor information in registry

Enumerates system info in registry

GoLang User-Agent

Modifies data under HKEY_USERS

Modifies registry class

Runs ping.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Browser Information Discovery

Detects Pyinstaller

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Creates a large amount of network flows

Enumerates connected drives

Checks BIOS information in registry

Checks computer location settings

Creates new service(s)

Cryptocurrency Miner

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Contacts a large (663) amount of remote hosts

Downloads MZ/PE file

Stealc

Stealc family

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Vidar family

Amadey

Amadey family

Detects Amadey x86-bit Payload

Detects DonutLoader

Detects Vidar Stealer

DonutLoader

Donutloader family

Quasar RAT

Quasar family

Quasar payload

Malware Config

C2 Extraction:

http://94.154.35.25
http://150.241.83.5

Unpacked files

SH256 hash:

cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

MD5 hash:

f9afa244d93f1123ad330b878418d050

SHA1 hash:

814dbc9de8685175d30c7cde18a09b97bc2ed458

Link:

https://www.unpac.me/results/9f2b2c7a-9ac0-4d2b-9571-78985b4b6e1c/

SH256 hash:

f99c69a781b8cbb1139e308a173ac8092f72159a1dd32a37d55ab763d8f2d94d

MD5 hash:

b9c27da0758728c0001fa48de182175c

SHA1 hash:

37cf68129996649245274402a20945be9ab8cab2

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/9f2b2c7a-9ac0-4d2b-9571-78985b4b6e1c/

Parent samples :

043411ec48a610695668589c877e96b333b1a7b2ba07304ab0776339edf61cc1
b65e358f50489d16259f50dc37d3f997990b699980798aa5430877603717ec5d
1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882
e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649
63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71
df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663
cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

SH256 hash:

1a47995b128b736b51d5d24c6f7efdeb33b8c53bfb39819e5bef0ed9f54dff02

MD5 hash:

17e86ed9ea9a6987f128efd3b55aefd0

SHA1 hash:

93b08a57e57614e90f16b24ff7cd2cde45d0152f

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/9f2b2c7a-9ac0-4d2b-9571-78985b4b6e1c/

Parent samples :

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cfe0b6c72f2e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GoProxy

exe cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

(this sample)

Dropped by

Gcleaner

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/51230/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample