🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 17


Intelligence 17 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5
SHA3-384 hash: 45a932f0afe5c4bf40e8085de47e386f7c615ebb889fc22f9e4c3f3ca90278860ef93d899cd2836c452b334887297233
SHA1 hash: 93e5f586ae99c7da4731b29f845af42294a04a87
MD5 hash: 0521b02f1494d62f04e78eb4435443eb
humanhash: coffee-four-december-undress
File name:taskmanager.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:421'888 bytes
First seen:2026-09-06 20:07:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9de6be7a4c44b3d12f5f66ec980c3dfa (1 x Amadey)
ssdeep 6144:RJfjr/kDxy8zp5VBzrxa9+aTgQLQjB+a7d0fmkmZKasmGWzqFE5BUgAOU/vK5S4:RJfjr/kDx3z09xiga7d97hwgh5S4
TLSH T1AB944C213817C032D56091715E7AFFF685AD6D258B7149EBBBC40E375E202D2AA31F3A
TrID 22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.7% (.EXE) Win32 Executable (generic) (4504/4/1)
7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:Amadey exe upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987
File size (compressed) :169'984 bytes
File size (de-compressed) :421'888 bytes
Format:win32/pe
Packed file: 28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Amadey
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b6de7e4c-4e2f-4a6b-9e06-1a81a7cd360d/
Detection:
Amadey
Create hunting rule
Link:
https://www.capesandbox.com/analysis/84273/
Detection(s):
YARA.CAPE_Amadey.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac724df9acbb098cc29b8d2
Tags:
emotet nymaim delphi lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context amadey anti-debug base64 fingerprint lolbin microsoft_visual_cc nymaim reconnaissance wmic
Link:
https://www.filescan.io/uploads/6a9dc82e48cf513eb5e921d9/reports/9c721312-2954-4b06-9110-604f98ded4c5/overview
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-06T06:41:00Z UTC
Last seen:
2026-08-19T06:34:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5/results?tab=lookup
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5c53d473-337a-4f71-9c13-93ec83727834
Result
Threat name:
Amadey, Tofsee, Vidar, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1969122
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates / moves files in alternative data streams (ADS)
Creates multiple autostart registry keys
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries Google from non browser process on port 80
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected AntiVM3
Yara detected Tofsee
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1969122 Sample: taskmanager.exe Startdate: 06/09/2026 Architecture: WINDOWS Score: 100 105 sla.13balien.org 2->105 107 quag.cn 2->107 109 79 other IPs or domains 2->109 147 Suricata IDS alerts for network traffic 2->147 149 Found malware configuration 2->149 151 Malicious sample detected (through community Yara rule) 2->151 153 13 other signatures 2->153 11 taskmanager.exe 3 57 2->11         started        16 msedge.exe 2->16         started        18 aad37aeb7a.exe 2->18         started        20 3 other processes 2->20 signatures3 process4 dnsIp5 137 130.12.182.175, 49701, 8080 VPSDEDICATED-ASUS Slovenia 11->137 139 196.251.107.248, 49699, 49700, 80 FEMOITGB Germany 11->139 143 2 other IPs or domains 11->143 97 C:\Users\user\AppData\...\3ae60a87ac.exe, PE32+ 11->97 dropped 99 C:\Users\user\AppData\...\aad37aeb7a.exe, PE32 11->99 dropped 101 C:\Users\user\AppData\...\070d9dcce5.exe, PE32+ 11->101 dropped 103 3 other malicious files 11->103 dropped 181 Creates multiple autostart registry keys 11->181 22 21.exe 2 11->22         started        26 4BtqZz1.exe 16 1 11->26         started        29 070d9dcce5.exe 11->29         started        39 2 other processes 11->39 141 239.255.255.250 unknown ZZ 16->141 183 Maps a DLL or memory area into another process 16->183 31 msedge.exe 16->31         started        33 msedge.exe 16->33         started        35 msedge.exe 16->35         started        41 4 other processes 18->41 37 firefox.exe 20->37         started        file6 signatures7 process8 dnsIp9 85 C:\Users\user\AppData\Local\Temp\...\21.tmp, PE32 22->85 dropped 155 Multi AV Scanner detection for dropped file 22->155 157 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 22->157 43 21.tmp 3 4 22->43         started        123 sla.13balien.org 104.21.86.67 CLOUDFLARENET-CloudflareIncUS Canada 26->123 125 telegram.me 149.154.167.99 TELEGRAMVG United Kingdom 26->125 159 Found many strings related to Crypto-Wallets (likely being stolen) 26->159 161 Found strings related to Crypto-Mining 26->161 163 Writes to foreign memory regions 26->163 171 3 other signatures 26->171 46 RuntimeBroker.exe 26->46         started        127 nn.143slot.org 104.21.39.86 CLOUDFLARENET-CloudflareIncUS Canada 29->127 165 Tries to harvest and steal browser information (history, passwords, etc) 29->165 167 Tries to detect virtualization through RDTSC time measurements 29->167 169 Uses the Windows Restart Manager Abuse for Browser Credential File unlocking 29->169 129 ln-0007.ln-msedge.net 150.171.22.17 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 31->129 131 ax-0002.ax-msedge.net 150.171.27.11 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 31->131 133 23 other IPs or domains 31->133 135 5 other IPs or domains 37->135 48 firefox.exe 37->48         started        87 C:\Users\user\AppData\Local\Temp\...\21.tmp, PE32 39->87 dropped 50 chrome.exe 39->50         started        52 21.tmp 3 4 39->52         started        54 msedge.exe 39->54         started        56 2 other processes 39->56 file10 signatures11 process12 file13 93 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 43->93 dropped 58 21.exe 2 43->58         started        61 chrome.exe 50->61         started        95 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 52->95 dropped 64 msedge.exe 54->64         started        process14 dnsIp15 91 C:\Users\user\AppData\Local\Temp\...\21.tmp, PE32 58->91 dropped 66 21.tmp 5 12 58->66         started        145 192.168.2.4, 443, 49697, 49699 unknown unknown 61->145 69 chrome.exe 61->69         started        file16 process17 dnsIp18 77 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 66->77 dropped 79 C:\ProgramData\...\is-U7GKJ1G0A6.tmp, PE32 66->79 dropped 81 C:\ProgramData\...\is-OPVGJGYN37.tmp, PE32 66->81 dropped 83 4 other malicious files 66->83 dropped 72 GDFwAdmin.exe 66->72         started        111 www3.l.google.com 142.250.72.14 GOOGLE-GoogleLLCUS United States 69->111 113 www.google.com 142.251.154.119 GOOGLE-GoogleLLCUS United States 69->113 115 7 other IPs or domains 69->115 file19 process20 dnsIp21 117 quag.cn 45.150.195.126 ZHOUYISAT-COMMUNICATIONS-ZhouyiSatCommunicationsUS Spain 72->117 119 142.251.150.119 GOOGLE-GoogleLLCUS United States 72->119 121 26 other IPs or domains 72->121 89 C:\Users\user:.repos, data 72->89 dropped 173 Creates / moves files in alternative data streams (ADS) 72->173 175 Found strings related to Crypto-Mining 72->175 177 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 72->177 179 2 other signatures 72->179 file22 signatures23
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/0521b02f1494d62f04e78eb4435443eb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2026-05-06 09:04:24 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ohuzd7d323dhdcwdpv6rz3vdsl6sjuqoukrfcsok6omz27ol72q._file
Verdict:
malicious
Label(s):
Amadey
Create hunting rule
Link:
https://reports.threatray.com/356074f3-fb1c-4a4f-b7f6-757ff8731a84
Result
Malware family:
tofsee
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:tofsee discovery installer trojan upx
Link:
https://tria.ge/reports/260906-ywmphazvct/
Behaviour
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
System Location Discovery: System Language Discovery
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Detects Amadey x86-bit Payload
Family: Amadey
Family: Tofsee
Malware Config
C2 Extraction:
http://196.251.107.248
quag.cn
jotunheim.name
Unpacked files
SH256 hash:
d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5
MD5 hash:
0521b02f1494d62f04e78eb4435443eb
SHA1 hash:
93e5f586ae99c7da4731b29f845af42294a04a87
Link:
https://www.unpac.me/results/3ebb65ab-2a40-444b-9f76-a450e43c05e7/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d38f4c8fe3de/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Amadey
Create hunting rule
Author:kevoreilly, YungBinary
Description:Amadey Payload
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:win_amadey
Create hunting rule
Author:Bitsight
Description:Detects Amadey v5.55+ payload (x86 and x64): RC4 stream cipher implementation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Amadey

Executable exe 28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987

Amadey

Executable exe d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5

(this sample)

  
Dropped by
SHA256 28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987
Cape
Cape
https://www.capesandbox.com/analysis/84273/
  
Dropped by
MD5 f05dada33b1b43b4281c2ea748b9c1ae

Comments