MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 18

Intelligence 18 IOCs 1 YARA 23 File information Comments

SHA256 hash:	df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663
SHA3-384 hash:	ddd8a2db16deecd2eaeea7e489f481186a765dd3b48256be022f2f7e9a5940e1b9bd1d96e1040fb102235c9c3ef09b30
SHA1 hash:	56e7319607a01fd754fafa36e9ec71a8796777f1
MD5 hash:	389e193726c22d59af96709c9d82b8f1
humanhash:	potato-single-bakerloo-music
File name:	file
Download:	download sample
Signature	Amadey Create hunting rule
File size:	496'128 bytes
First seen:	2026-02-01 19:45:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'854 x Amadey, 290 x Smoke Loader)
ssdeep	6144:KFy+bnr+tp0yN90QEWIqHq7Lfdt3LmrXiQQRcrbtfc6sN+8UAsqFOqmu3Fe1uPxs:TMrZy900K7rbhDc+6uhb8+DJXiQVG
Threatray	1 similar samples on MalwareBazaar
TLSH	T1E1B4020BE5E99031DC58877058E701C31636FA902A589793778FEE5B2CB32B1B77522B
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Bitsight
Tags:	Amadey dropped-by-gcleaner exe f LAB.file

Bitsight

url: http://195.178.136.38/service

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://astrologickeconoablos.cc:8080/updater?for=07AE43EC57B400B48380A0EB83234BF7	https://threatfox.abuse.ch/ioc/1739840/

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

redline

ID:

File name:

_df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663.exe

Verdict:

Malicious activity

Analysis date:

2026-02-01 19:47:36 UTC

Tags:

auto redline stealer amadey botnet loader auto-reg stealc vidar credentialflusher generic gcleaner neoreklami adware auto-sch auto-startup upx xor-url wallstealer autoit rdp purelogs salatstealer ms-smartcard telegram uac evasion quasar rat arch-doc

Link:

https://app.any.run/tasks/851aff33-938d-4d5d-ae2f-7299b440fc71

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/51127/

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Win.Malware.Generic-10058845-0

Win.Malware.Xeu2gbl-10058901-0

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=697fad98d93e7233498c6a7c

Tags:

autorun emotet cobalt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context amadey amadey anti-vm base64 CAB explorer fingerprint installer installer installer-heuristic lolbin lolbin microsoft_visual_cc mikey netsh packed packed packed rundll32 runonce schtasks sfx stealer vidar wmic

Link:

https://www.filescan.io/uploads/697fad90c9bfb60ece1a295a/reports/a6f37576-e0f9-47a5-9e99-dcea8a8e6451/overview

Verdict:

Malicious

Labled as:

Crifi.Generic

Link:

https://www.hybrid-analysis.com/sample/df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-02-01T16:51:00Z UTC

Last seen:

2026-02-01T19:36:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Win32.Vidar.d Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.TCP.C&C Trojan-Downloader.Agent.TCP.C&C VHO:Trojan-Downloader.Win32.Convagent.gen BSS:Exploit.Win32.Generic HEUR:Trojan-Downloader.Win32.Deyma.gen Trojan-PSW.Stealerc.HTTP.C&C PDM:Trojan.Win32.Generic Trojan.Agentb.TCP.C&C Trojan-Downloader.Win32.Deyma.sb Trojan-Downloader.PsDownload.HTTP.C&C Trojan-Downloader.Agent.HTTP.C&C VHO:Trojan-PSW.Win32.Vidar.gen Trojan-PSW.Lumma.HTTP.Download BSS:Trojan.Win32.Generic Trojan-PSW.Win32.Vidar.hev Trojan-Dropper.Win32.Agent.sb Trojan.Nymaim.HTTP.ServerRequest

Link:

https://opentip.kaspersky.com/df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e1235a86-304c-450e-bd88-7d61e6b0e6b8

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/389e193726c22d59af96709c9d82b8f1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663/

Verdict:

Malicious

Threat:

Family.REDLINE

Link:

https://tip.neiki.dev/file/df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2026-02-01 19:46:28 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=35bptpvrb6gvwzu4hqdgomcidhrtxkpzeqgi2phl6kkno7dfwzrq._file

Verdict:

malicious

Label(s):

amadey

Similar samples:

error

Amadey

Result

Malware family:

vidar

Score:

10/10

Tags:

family:amadey family:vidar botnet:fbf543 collection defense_evasion discovery execution installer miner persistence spyware stealer trojan upx

Link:

https://tria.ge/reports/260201-yg58asew8b/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

GoLang User-Agent

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Modifies registry key

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Inno Setup is an open-source installation builder for Windows applications.

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Enumerates processes with tasklist

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Looks up external IP address via web service

Checks BIOS information in registry

Checks computer location settings

Creates new service(s)

Cryptocurrency Miner

Disables service(s)

Drops startup file

Executes dropped EXE

Identifies Wine through registry keys

Indirect Command Execution

Loads dropped DLL

Modifies file permissions

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Stops running service(s)

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Amadey

Amadey family

Detects Amadey x86-bit Payload

Detects Vidar Stealer

Modifies WinLogon for persistence

Vidar

Vidar family

Malware Config

C2 Extraction:

http://94.154.35.25

Unpacked files

SH256 hash:

df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663

MD5 hash:

389e193726c22d59af96709c9d82b8f1

SHA1 hash:

56e7319607a01fd754fafa36e9ec71a8796777f1

Link:

https://www.unpac.me/results/a69a9a32-bfc3-48e1-95cb-30b1d57e785f/

SH256 hash:

f99c69a781b8cbb1139e308a173ac8092f72159a1dd32a37d55ab763d8f2d94d

MD5 hash:

b9c27da0758728c0001fa48de182175c

SHA1 hash:

37cf68129996649245274402a20945be9ab8cab2

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/a69a9a32-bfc3-48e1-95cb-30b1d57e785f/

Parent samples :

043411ec48a610695668589c877e96b333b1a7b2ba07304ab0776339edf61cc1
b65e358f50489d16259f50dc37d3f997990b699980798aa5430877603717ec5d
1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882
e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649
63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71
df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663
cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

SH256 hash:

1a47995b128b736b51d5d24c6f7efdeb33b8c53bfb39819e5bef0ed9f54dff02

MD5 hash:

17e86ed9ea9a6987f128efd3b55aefd0

SHA1 hash:

93b08a57e57614e90f16b24ff7cd2cde45d0152f

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/a69a9a32-bfc3-48e1-95cb-30b1d57e785f/

Parent samples :

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/df42f9beb10f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

exe df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663

(this sample)

Dropped by

Gcleaner

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/51127/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample