Payload Details

First Seen	2026-02-20 (Login for timestamps)
Last Seen	2026-02-23
SHA256	73268ba4f02818b8597b585147be43155afd621fa098eec72d1a3c4e7d341a31
Filetype	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Size	442,368 bytes
Distributed By	Vidar (Login)
Countries	Login for country information
UnpacMe ID	7b7bd176-8723-47c1-aee2-0a11eca763f9
UnpacMe Detections	MALWARE:AmadeyTYPE:DOWNLOADERRULE:AmadeyCONFIG:Amadey
UnpacMe Community	RULE:win_amadey_auto
Sandbox Detections	AmadeyGCleanerCoinMiner
Malcat Kesakode	One of the process dumps is 26% similar to VidarVidar 26%One of the process dumps is 35% similar to GCleanerGCleaner 35%
Download	Login

Monitored Sandbox Execution

Non-Monitored Sandbox Execution

Tasks of Origin (49)