9d2ca3

Amadey-downloader-dropped second-stage payload cluster. OpenCTI internal family label; co-tagged dropped-by-amadey across 20+ corpus samples.

Contested: The label covers at least two distinct build clusters: (1) MinGW-w64 PE32+ droppers with encrypted .data payloads, and (2) Go 1.25.4 PE64 infostealers with randomized module paths and fabricated Authenticode. Sample a7b9f3dd belongs to cluster (2) but carries the same OpenCTI label. ^[/intel/analyses/a7b9f3dda435b7f2d0dfbd1e0c8d50cb824cb60fe3343a61a5fd6aa643763c4e.html]

Overview

The 9d2ca3 label groups a class of Windows x64 droppers dropped by the Amadey downloader botnet. Every observed sample follows the same build template: a MinGW-w64 PE32+ with a tiny .text section (< 50 KB) and an oversized .data section (2–3 MB) that carries the encrypted secondary payload. The import table is stripped to C runtime imports plus VirtualProtect and Sleep. No .rsrc section, no signing, no embedded icons.

All samples in this cluster have been static-only in this corpus: no CAPE Windows guest is available, and capa/floss tooling is not configured. The inner payload and C2 infrastructure remain opaque until dynamic detonation.

Build Stack

• Toolchain: MinGW-w64, LinkVersion 14.0 (GCC 14.x era).
• Format: PE32+ x86-64, 7 sections (.text, .rdata, .data, .pdata, .00cfg, .tls, .reloc).
• Linker flags: ASLR + DEP + High Entropy VA enabled; no Control Flow Guard (.00cfg near-empty).
• Resource: Absent — no icon masquerade, no version-info masquerade.
• Signing: Unsigned across all observed samples.
• Import table: ~36 imports. Only msvcrt.dll (CRT) and KERNEL32.dll (VirtualProtect, Sleep, SetUnhandledExceptionFilter, TlsGetValue).
• Anti-analysis: Mild. __set_app_type gate present but is standard MinGW CRT behavior. The real defense is structural: near-zero imports and an encrypted .data magazine.

Deploy / TTPs

Go cluster variant (sample a7b9f3dd)

A distinct second-stager under the same label. Build fingerprint:

• Toolchain: Go 1.25.4, CGO_ENABLED=0, trimpath=true
• Module path: randomized per-build (e.g. uyiUNvZdvAGQnhv)
• Function names: ~28 randomized main-package symbols visible in .symtab
• Signing: Fabricated Authenticode (PE security dir with leaf CN=askart.com, issuer=WE1)
• Anti-analysis: No static C2, no .rsrc, junk delay loops in main.Jtruwhtr
• Behaviour: VirtualAlloc resolved via Go syscall._LazyProc_; probable in-memory payload staging

See full analysis at /intel/analyses/a7b9f3dda435b7f2d0dfbd1e0c8d50cb824cb60fe3343a61a5fd6aa643763c4e.html.

Go cluster variant (sample 29149758 — newer sibling)

Second observed Go infostealer under the same label, with significant builder drift:

• Toolchain: Go 1.25.4, CGO_ENABLED=0, trimpath=true
• Module path: wqeHivEQWBGOQgj (randomized)
• Function names: 39 randomized main-package symbols (up from 28 in a7b9f3dd)
• Signing: Same fabricated Authenticode serial as sibling cc4aa789 (CDDA1164C88E40890E189788E7C9F32B, CN=askart.com, issuer=WE1)
• Anti-analysis: Fused-string API decoding — DLL/API names are concatenated into .rdata blobs and sliced at runtime via syscall._LazyProc_; no standalone VirtualAlloc string in static output
• Behaviour: Custom in-memory PE export walker (main.fvcmychoeu), PRNG-seeded delay loops (main.Wqmcsrfqooezj), host fingerprinting (hostname, PID, pagesize), then enters an idle GUI loop
• Size: 12 MB (vs ~2.5 MB for a7b9f3dd) — suggests embedded payload or expanded string tables

See full analysis at /intel/analyses/2914975816372d0dc79b777915f66955d312213ea036b84ff16ad5ab0bcfdd66.html.

Go cluster variant (sample 389e1ccf — third sibling)

Third Go infostealer under the same label, confirming the cluster build pipeline:

• Toolchain: Go 1.25.4, CGO_ENABLED=0, trimpath=true, GOARCH=amd64, GOAMD64=v1
• Module path: LUOegnbUmXZeMZT (randomized)
• Function names: 43 randomized main.* identifiers (upward trend in symbol count)
• Signing: Fabricated Authenticode with godaddy.com string and WE1 marker in certificate blob; malformed ASN.1 blocks direct parsing — consistent with fabricated certs in siblings
• Anti-analysis: Same fused-string API decoding pattern (advapi32.dllGetUserNameAVirtualAllocrandautoseedsweepWaiters...)
• Behaviour: PRNG seed from system clock → sequential dispatch of 24 worker functions → hostname/PID/pagesize read → idle GUI loop
• Size: 2.48 MB (typical for this cluster)
• Filename: EclipseV2.exe (masquerade)

See full analysis at /intel/analyses/389e1ccf072f134de9d3b007df0952f43f2dc0c3a4f55fbe6f3035d1d0c14dc0.html.

.NET dropper variant (sample 2bf8e65c — fourth distinct morph)

A completely different build under the same opaque OpenCTI label. This is a .NET Framework 4.0 x64 PE compiled May 22 2026, internal name popit.exe, with a 2.1 MB IL-only .text section and a tiny .rsrc containing only the manifest. It does not share the MinGW or Go fingerprints observed in every prior sibling.

Key traits:

• Toolchain: .NET Framework 4.0 / CLR v4.0.30319, ILONLY flag, EntryPointToken 0x06000001.
• Payload delivery: Base64 + AES (RijndaelManaged + Rfc2898DeriveBytes) encrypted ZIP, extracted in-memory via System.IO.Compression.ZipArchive. No embedded RCData or secondary PE in .rsrc.
• Injection: P/Invoke imports for CreateProcess, VirtualAllocEx, WriteProcessMemory, ZwUnmapViewOfSection, SetThreadContext, ResumeThread — textbook process hollowing.
• Process targeting: WMI ManagementObjectSearcher queries Win32_Process for candidate host processes to hollow.
• Privilege elevation: Manifest requests requireAdministrator.
• Network hardening: Enforces TLS 1.2 via ServicePointManager.SecurityProtocol.
• Obfuscation: Garbage identifiers (flecduep, knzhwyemdmfotslhxivggphauaduuuzem, etc.) in metadata; no ConfuserEx / SmartAssembly name mangling.
• Signing: Unsigned.
• C2: None in static; C2 config is runtime-decrypted by the inner payload.
• Dynamic: CAPE skipped (no Windows guest). All behavior inferred from static imports + strings + capa.

This sample confirms the 9d2ca3 OpenCTI label is a grab-bag covering at least three unrelated build morphs: MinGW-w64 encrypted droppers, Go 1.25.4 infostealers, and now a .NET Framework 4.0 AES dropper with WMI hollowing.

See full analysis at /intel/analyses/2bf8e65cde6c51c07492255eb11f9ef2d7f02c5bd0337c1e7b1c9266d73843ce.html.

Notable Analyses

• /intel/analyses/2d39ed5ea7f2547233f534c4e78edef047051c26c115ac120663705be96b8e5d.html — Deep-dive on the MinGW-w64 shell, oversized .data decryption, and structural anomalies.

Capabilities

• oversized-encrypted-data-section
• mingw-w64-build-artifacts
• minimal-import-table
• virtualprotect-memory-remapping
• sleep-delay-anti-sandbox
• data-section-payload-decryption
• go-lazyproc-virtualalloc-runtime-resolution
• fused-string-api-decoding
• go-custom-pe-export-walker
• prng-seeded-sandbox-delay
• host-fingerprinting-idle-loop
• dotnet-aes-base64-resource-decryption
• wmi-process-enumeration
• process-hollowing-via-pinvoke
• tls-1.2-enforcement
• manifest-admin-elevation

Related

• peb-walking-api-resolution — Some Amadey payloads use PEB export-hash walking for API resolution, though this stub relies on the import table.
• Amadey downloader (external, Malpedia win.amadey) — the upstream delivery mechanism for this cluster.