This article was originally published on ThreatChain — decentralized threat intelligence.

It doesn't steal your data — it opens the door for everything else. Ransomware, stealers, miners. This loader delivers them all.

A new Amadey sample was identified by threat intelligence feeds on 2026-04-26 17:16:40. This post breaks down what we know about the specific sample, how to recognize related activity on your network, and what to do if you or your organization might be affected.

The Sample at a Glance

Field Value

SHA-256 213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052

File name file

File type exe

Size 2.09 MB

Origin (first observed) US

First seen 2026-04-26 17:16:40

Family Amadey

Tags 1TEST.file, A, Amadey, dropped-by-GCleaner, exe, signed

VirusTotal detection 23/75 engines flagged malicious

What Amadey Does

Amadey is a malware family observed delivering malicious payloads to Windows systems.…