c-f-u.com: a server that handed out a Windows program and credential and clipboard plugins, and what to do if one ran on your PC

What c-f-u.com is, and what we know about it

c-f-u.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this one address, so what follows is what URLhaus shows, what we saw ourselves, and what security vendors have published about the malware family that the file names match.

1. 1

   What URLhaus lists

   Five file addresses on c-f-u.com, all under one folder with a random looking name, g84kfS5n. One is in a subfolder called Uploads and is named build_amd.exe_Melted.exe. Four are in a subfolder called Plugins: cred.dll, cred64.dll, clip.dll and clip64.dll. All were added within four seconds of each other, on 15 October 2026 at about 15:37 UTC, all carry the threat label malware_download, and the reporter is anonymous. When we read the data, all five were marked offline.

2. 2

   What the tags mean

   The tags are only the file types: exe for the program and dll for the four plugins. A dll is a library that another program loads and runs. URLhaus gives no malware family name for these entries, so the family is not stated by the reporter.

3. 3

   Why we think of Amadey

   Splunk and Zscaler describe a Windows bot called Amadey that downloads plugins named cred.dll, cred64.dll, clip.dll and clip64.dll from its control server. Four of the five names on c-f-u.com are exactly those. That is our reading of the file names and a pattern match, not a confirmed identification. We did not download any file, so we cannot tell you what is inside them.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these files. A normal visitor has no reason to ask for them.

Kind of threat

A server that handed out one Windows program and four plugin DLLs, reported as malware_download

Where the files were

hxxp://c-f-u[.]com/g84kfS5n/Uploads/ and hxxp://c-f-u[.]com/g84kfS5n/Plugins/: plain http

Domain registered

16 September 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com (RDAP, read 15 October 2026). Status includes client hold

URLhaus entries

5 file addresses, all added on 15 October 2026 between 15:37:12 and 15:37:16 UTC; all offline when we read the data

Family

Not stated by URLhaus. The plugin names match the Amadey bot (our reading)

Platform

Windows. Exe and dll files are Windows formats. Nothing we read says Mac, iPhone or Android are affected

What we checked on 17 October 2026, and what we could not

Our server made one plain request to c-f-u.com on 17 October 2026. It failed before anything was sent: the name could not be found (error ENOTFOUND). That clears nothing. A malware server that is switched off, removed or put on hold is not a safe server, it is one that is quiet today.

What happened to c-f-u.com, from registration to our check

The domain is only about a month old and all the reports are from one afternoon. The dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 16 September 2026

   The domain is registered

   RDAP shows c-f-u.com registered on 16 September 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. That is 29 days before the reports. A new domain used for malware is common, but a new domain alone proves nothing.

2. 15 October 2026, 15:37 UTC

   Five files are reported within four seconds

   Between 15:37:12 and 15:37:16 UTC an anonymous reporter adds clip.dll and clip64.dll, then cred.dll and cred64.dll, then build_amd.exe_Melted.exe. The order and the speed suggest one person, or one tool, reading the server's folders and submitting what it found. That is our reading of the timestamps.

   

3. 15 October 2026, 18:46 UTC

   Registration data is read

   Our RDAP lookup the same day shows the domain with the statuses client delete prohibited, client hold, client renew prohibited, client transfer prohibited and client update prohibited. The hold means the domain may already have been stopped at that point.

4. 17 October 2026

   Our request finds no address

   Our server cannot resolve the name. All five URLhaus entries are marked offline.

What the pattern suggests, and what it does not: a domain that appears, serves its files and is reported within weeks fits a short lived delivery server. It does not tell us how many PCs asked for the files, because the server side shows no downloads. The same operator may have moved on to another name.

What the file names point to: the Amadey bot

Amadey is a Windows trojan that has been seen since at least October 2018. It is a bot: it collects facts about the PC, reports to a control server, and downloads whatever its operator wants next. The plugins named on c-f-u.com are the part that steals.

Two cautions. First, the sources describe Amadey builds from earlier years; the files on c-f-u.com may be an unrelated tool that reuses the same plugin names, or a newer build with different behaviour. Second, the sources differ on file names and plugin sets from build to build, so treat the table as the general pattern of the family, not as a description of these five files.

What a bot with these plugins can take from a Windows PC

The list below is what the sources say the family and its plugins can do, not what these five files did. A bot that downloads more files can also be given other jobs, so the real limit is what the operator decides to send.

The sources do not say which of these a given victim lost. The clipboard plugin matters for crypto in particular, because a copied wallet address is the one thing people paste into a payment. We found no source that describes a wallet address swap for the c-f-u.com files, so treat that as a possible use, not a seen one.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where something fetched these files and ran them.

• High

  Passwords and accounts

  Saved browser logins can be read, so email, shops, work tools and social accounts are exposed. A stolen email login is the worst, because it resets the rest.

• High

  Crypto and payments

  A clipboard reader sees every wallet address, seed phrase or card number you copy. Crypto sent to the wrong address cannot be brought back.

• Medium

  Server and remote logins

  If you keep saved FTP, WinSCP or VNC sessions, one build is reported to take them. A stolen login to a website server can lead to that site being used to spread malware.

• Medium

  More malware on the same PC

  A bot of this kind is a door. MITRE says it downloads and runs further malware, so the PC may carry more than the five files we know of.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Credential stealers are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and most victims notice nothing until an account is used.

How a person ends up asking for these files

Nobody visits c-f-u.com on purpose. The request comes from a program, so the real question is how that program got onto the PC. For this server we cannot say, because the server side shows no victims. The routes below are the ordinary ways of getting a bot like this, and none of them is confirmed for these files.

1. 1

   A downloaded file that looks like something else

   Bots of this kind are usually started by a first file the user ran: a cracked program, a fake installer, a key generator or a fake update. If you ran something like that around mid October 2026, treat it as the likely start. This is a general pattern, not something we saw for this server.

2. 2

   A file that was already on the PC

   The first file is only a small downloader. It asks the server for the main program and the plugins and runs them. That is why the five files sit on the server rather than being sent in an email.

3. 3

   A link or attachment

   A phishing email or a message that leads to a download is another common start. Opening the file and allowing it to run is what begins the chain.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact c-f-u.com, or did you run a cracked program, an installer from a doubtful site or an unexpected attachment recently? If you saw the name in a firewall or DNS log on your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A bot needs the connection to send data and to receive orders.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of first contact, and note its name. Microsoft says the results of an offline scan also appear there.

4. 4

   Look at Startup apps

   Open Settings > Apps > Startup. Look for names you did not install, especially ones with random names or from a user folder. Do not delete yet; write the name and the file path.

5. 5

   Look at the Startup folder

   Press Windows key + R, type shell:startup and press Enter. MITRE says the bot sets keys so its program runs from the Startup folder, so a file or shortcut here that you did not put there is worth a note. An empty folder does not clear the PC.

6. 6

   Look at running processes

   Open Task Manager and look at the Processes tab for programs you do not know, or for high network use from something you do not recognise. Right-click a process and choose Open file location to see where it lives. rundll32.exe is a normal Windows program, so its presence is not proof.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank, shop and exchange accounts, and at crypto balances. This is quicker than any file check, and a stolen login shows up there first.

8. 8

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not download these files and infected no PC, so the order of the plan below is our judgement from Microsoft and FTC pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The file types and every source we read describe a Windows threat. We found nothing that says the files on c-f-u.com affect anything else.