MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Amadey

Vendor detections: 18

Intelligence 18 IOCs YARA 38 File information Comments

SHA256 hash:	e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649
SHA3-384 hash:	d491bb5d63fd3f2824639743461a7b41911d6ca6348e48344abeb8c82cc44e52c584c2ef590c3868fe26acdf25513504
SHA1 hash:	7c2c3626bfbc078b0bb5c1e0636d87ee66de8ed2
MD5 hash:	bf1b74abaae20d0002ccb05f03de7a54
humanhash:	april-bacon-monkey-fix
File name:	file
Download:	download sample
Signature	Amadey Create hunting rule
File size:	496'128 bytes
First seen:	2026-02-01 05:57:33 UTC
Last seen:	2026-02-01 06:30:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'854 x Amadey, 290 x Smoke Loader)
ssdeep	6144:K+y+bnr+1p0yN90QEqIqHq7Lfdt3LmrXiQQRcrbtfc6sN+8UAsqFOqmu3Fe1uPxE:2MrRy90sK7rbhDc+6uhb8+DJXiQVK
Threatray	1 similar samples on MalwareBazaar
TLSH	T1DBB4020BE5E89031DC94877054F701C31A36FA912B5897A3678FED5A29B32F1B37522B
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Bitsight
Tags:	Amadey dropped-by-gcleaner exe f LAB.file

Bitsight

url: http://195.178.136.38/service

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

redline

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-02-01 05:58:21 UTC

Tags:

auto redline stealer amadey botnet stealc vidar evasion uac loader quasar rat auto-reg salatstealer arch-doc credentialflusher neoreklami adware auto-sch gcleaner generic python rdp api-base64 kamasers udados xor-url upx purecrypter purelogs xmrig miner pastebin goproxy winring0-sys vuln-driver

Link:

https://app.any.run/tasks/24bc0295-8e4d-4d7a-930e-54737aef266f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/51077/

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Win.Malware.Generic-10058845-0

Win.Malware.Xeu2gbl-10058901-0

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=697eeb7d848d0f834c8c530f

Tags:

autorun emotet delphi cobalt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context amadey amadey anti-vm base64 CAB cmd explorer fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc mikey netsh obfuscated packed packed packed rundll32 runonce schtasks sfx stealer unsafe vidar wmic

Link:

https://www.filescan.io/uploads/697eeb722ffccda097652df2/reports/ff380dc8-4029-4c3e-94da-8eb97a0b912b/overview

Verdict:

Malicious

Labled as:

Crifi.Generic

Link:

https://www.hybrid-analysis.com/sample/e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-02-01T03:05:00Z UTC

Last seen:

2026-02-01T05:54:00Z UTC

Hits:

~10

Detections:

Trojan.Agentb.TCP.C&C Trojan-Dropper.Win32.Agent.sb Trojan-Downloader.Win32.Deyma.sb HEUR:Trojan-Downloader.Win32.Deyma.gen Trojan-Downloader.Agent.HTTP.C&C VHO:Trojan-PSW.Win32.Vidar.gen BSS:Trojan.Win32.Generic Trojan-PSW.Win32.Vidar.d Trojan-Downloader.Agent.TCP.C&C Trojan.Nymaim.HTTP.ServerRequest BSS:Exploit.Win32.Generic Trojan-PSW.Win32.Vidar.hev Trojan-PSW.Vidar.HTTP.C&C VHO:Trojan-Downloader.Win32.Convagent.gen Trojan-PSW.Lumma.HTTP.Download Trojan-Downloader.PsDownload.HTTP.C&C PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/547fed6e-a980-4109-9c38-4949282e076a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/bf1b74abaae20d0002ccb05f03de7a54

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649/

Verdict:

Malicious

Threat:

Family.AMADEY

Link:

https://tip.neiki.dev/file/e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2026-02-01 05:58:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4imjs7gxq47xoijjniufm4q4mkbj5y5dvfldmbbczghwijftszeq._file

Verdict:

malicious

Label(s):

amadey

Similar samples:

error

Amadey

Result

Malware family:

vidar

Score:

10/10

Tags:

family:amadey family:gcleaner family:vidar botnet:fbf543 collection credential_access defense_evasion discovery execution installer loader miner persistence privilege_escalation pyinstaller spyware stealer trojan upx

Link:

https://tria.ge/reports/260201-gpa9fsa14d/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

GoLang User-Agent

Modifies data under HKEY_USERS

Modifies registry class

NTFS ADS

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Inno Setup is an open-source installation builder for Windows applications.

Browser Information Discovery

Detects Pyinstaller

Enumerates physical storage devices

Event Triggered Execution: Accessibility Features

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

ACProtect 1.3x - 1.4x DLL software

Checks BIOS information in registry

Checks computer location settings

Creates new service(s)

Cryptocurrency Miner

Executes dropped EXE

Indirect Command Execution

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Stops running service(s)

Unsecured Credentials: Credentials In Files

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Amadey

Amadey family

Detects Amadey x86-bit Payload

Detects Vidar Stealer

GCleaner

Gcleaner family

Suspicious use of NtCreateUserProcessOtherParentProcess

UAC bypass

Vidar

Vidar family

Malware Config

C2 Extraction:

http://94.154.35.25
185.156.73.98

Unpacked files

SH256 hash:

e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649

MD5 hash:

bf1b74abaae20d0002ccb05f03de7a54

SHA1 hash:

7c2c3626bfbc078b0bb5c1e0636d87ee66de8ed2

Link:

https://www.unpac.me/results/4268eb4b-bc19-40d9-8df7-3c5fa529086b/

SH256 hash:

f99c69a781b8cbb1139e308a173ac8092f72159a1dd32a37d55ab763d8f2d94d

MD5 hash:

b9c27da0758728c0001fa48de182175c

SHA1 hash:

37cf68129996649245274402a20945be9ab8cab2

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/4268eb4b-bc19-40d9-8df7-3c5fa529086b/

Parent samples :

043411ec48a610695668589c877e96b333b1a7b2ba07304ab0776339edf61cc1
b65e358f50489d16259f50dc37d3f997990b699980798aa5430877603717ec5d
1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882
e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649
63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71
df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663
cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

SH256 hash:

1a47995b128b736b51d5d24c6f7efdeb33b8c53bfb39819e5bef0ed9f54dff02

MD5 hash:

17e86ed9ea9a6987f128efd3b55aefd0

SHA1 hash:

93b08a57e57614e90f16b24ff7cd2cde45d0152f

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/4268eb4b-bc19-40d9-8df7-3c5fa529086b/

Parent samples :

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e218997cd787/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	Detect_Zoom_Invite_malware_RAT_C2 Create hunting rule
Author:	daniyyell
Description:	Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	sus_pe_free_without_allocation Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

exe e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649

(this sample)

Dropped by

Gcleaner

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/51077/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample