File name:	700b9d150d08eb2f75204e27756af52dec5ab54fda41fd581a03e8d9a5dec726.bin
Full analysis:	https://app.any.run/tasks/b31d4cb6-9eb5-46bd-a6b4-54d83cd5f463
Verdict:	Malicious activity
Threats:	Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	June 21, 2025, 23:10:28
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	loader amadey botnet stealer rdp
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	51C455F615CE7083B92D2B7D985EAF56
SHA1:	839A19049931E2409654FF3A1BE5B7706EEED3CC
SHA256:	700B9D150D08EB2F75204E27756AF52DEC5AB54FDA41FD581A03E8D9A5DEC726
SSDEEP:	49152:RPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtE8X4:tP/mp7t3T4+B/btosJwIA4hHmZlKH2TT

.exe	\|	Win64 Executable (generic) (76.4)
.exe	\|	Win32 Executable (generic) (12.4)
.exe	\|	Generic Win/DOS Executable (5.5)
.exe	\|	DOS Executable Generic (5.5)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2025:06:21 22:49:07+00:00
ImageFileCharacteristics:	Executable, Large address aware, 32-bit
PEType:	PE32
LinkerVersion:	14.16
CodeSize:	633856
InitializedDataSize:	326144
UninitializedDataSize:	-
EntryPoint:	0x20577
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	0.0.0.0
ProductVersionNumber:	0.0.0.0
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (British)
CharacterSet:	Unicode


(PID) Process:	(2492) mshta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(2492) mshta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(2492) mshta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(5692) powershell.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing

PID	Process	Filename		Type
1044	700b9d150d08eb2f75204e27756af52dec5ab54fda41fd581a03e8d9a5dec726.bin.exe	C:\Users\admin\Desktop\HIJUwfPxX.hta		html
		MD5:0DDEE407270EE6B519F4B79A1750D4B5	SHA256:73715E6A39E17461F3D25AC528825A15D3BDFD0722562991E30E25A664F4CE53
5692	powershell.exe	C:\Users\admin\AppData\RoamingF8XPWSOZYEA8A552ESRMI7RNOR06XDVE.EXE		executable
		MD5:26CC5A6CFD8E8ECC433337413C14CDDB	SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
5692	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ht4kke5y.fmu.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1760	RoamingF8XPWSOZYEA8A552ESRMI7RNOR06XDVE.EXE	C:\Windows\Tasks\ramez.job		binary
		MD5:AF7082E3FE576EDD0336A2CF6EBE83AA	SHA256:27ED25C842D1590FBF5AB0FD5A8542C750CC941A91F82AC4FB05B79078C6378A
5692	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_grxltaat.poy.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1760	RoamingF8XPWSOZYEA8A552ESRMI7RNOR06XDVE.EXE	C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe		executable
		MD5:26CC5A6CFD8E8ECC433337413C14CDDB	SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
5692	powershell.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive		binary
		MD5:76673CB8ACFECDB0C785BBA8B6520EC2	SHA256:5554FE5F8535C7D6FDD1BA7C503B5E1320AEA217F9C8E34308D4D6A183B1EF7C

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3964	RUXIMICS.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3964	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5692	powershell.exe	GET	200	185.156.72.2:80	http://185.156.72.2/testmine/random.exe	unknown	—	—	unknown
3756	ramez.exe	POST	200	185.156.72.96:80	http://185.156.72.96/te4h2nus/index.php	unknown	—	—	unknown
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
3964	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
3964	RUXIMICS.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3964	RUXIMICS.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146	whitelisted
google.com	142.250.185.238	whitelisted
crl.microsoft.com	184.24.77.37 184.24.77.12 184.24.77.35 184.24.77.42 184.24.77.6	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	104.208.16.90	whitelisted

PID	Process	Class	Message
5692	powershell.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
5692	powershell.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5692	powershell.exe	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
5692	powershell.exe	Misc activity	ET INFO Packed Executable Download
5692	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3756	ramez.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
3756	ramez.exe	Malware Command and Control Activity Detected	ET MALWARE Amadey CnC Response

General Info

700b9d150d08eb2f75204e27756af52dec5ab54fda41fd581a03e8d9a5dec726.bin

51C455F615CE7083B92D2B7D985EAF56

839A19049931E2409654FF3A1BE5B7706EEED3CC

700B9D150D08EB2F75204E27756AF52DEC5AB54FDA41FD581A03E8D9A5DEC726

49152:RPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtE8X4:tP/mp7t3T4+B/btosJwIA4hHmZlKH2TT

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Uses Task Scheduler to run other applications

Run PowerShell with an invisible window

Script downloads file (POWERSHELL)

AMADEY mutex has been found

AMADEY has been detected (YARA)

AMADEY has been detected (SURICATA)

Connects to the CnC server

Request from PowerShell that ran from MSHTA.EXE

SUSPICIOUS

Starts CMD.EXE for commands execution

Starts POWERSHELL.EXE for commands execution

Probably download files using WebClient

Manipulates environment variables

Process requests binary or script from the Internet

Executable content was dropped or overwritten

Potential Corporate Privacy Violation

Reads security settings of Internet Explorer

Contacting a server suspected of hosting an CnC

Connects to the server without a host name

Starts itself from another location

There is functionality for taking screenshot (YARA)

The process executes via Task Scheduler

There is functionality for enable RDP (YARA)

Starts process via Powershell

Found IP address in command line

INFO

Checks supported languages

Reads mouse settings

The sample compiled with english language support

Reads the computer name

Reads Internet Explorer settings

The executable file from the user directory is run by the Powershell process

Checks proxy server information

Process checks computer location settings

Create files in a temporary directory

Reads the software policy settings

Disables trace logs

Malware configuration

Amadey

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Malware configuration

Amadey

Information

Modules

Information

Modules