d-j-d.com: an Amadey malware server with stealer and clipper plugins, and what to do if a PC fetched them

What d-j-d.com is, and what we know about it

d-j-d.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write-up of this one address, so what follows is what URLhaus shows, what we measured ourselves, and what MITRE, Splunk and Picus Security have published about Amadey, the malware family the files are tagged with.

1. 1

   What URLhaus lists

   Six file addresses on d-j-d.com, all in a folder named g84kfS5n, all on plain http. Two are in a sub folder called Uploads: build_amd.exe_Melted.exe and inject-test.exe_Melted.exe. Four are in a sub folder called Plugins: cred.dll, cred64.dll, clip.dll and clip64.dll. All six were added on 15 October 2026, between 14:58 and 16:12 UTC, and all carry the threat label malware_download.

2. 2

   What the tags mean

   Both .exe files carry the tag dropped-by-amadey, which says the files were seen being delivered by Amadey, and each carries a short code (317106 and f4d9f4). We could not find out what those codes stand for; they may be build or campaign labels, but that is a guess. The four DLLs carry only the tag dll. The two programs were reported by Bitsight, a security company; the four plugins came from an anonymous reporter.

3. 3

   Why the plugin names matter

   Security write-ups of Amadey describe two add-on modules, a credential stealer named cred and a clipboard clipper named clip, each with a 32 bit and a 64 bit version (cred64 and clip64). The four DLL names on d-j-d.com match that set exactly. The same pattern of an Uploads and a Plugins folder under a random folder name is how Amadey control panels are usually laid out, which is our reading of the paths and not a statement from any report.

4. 4

   What we could not confirm

   We did not download any file, so we cannot tell you what is inside them, which Amadey version they belong to or where they report to. URLhaus shows tags, not proof. We also do not know which program or message makes a victim's PC ask for these files. That first step is not visible from the server side.

5. 5

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these files. A normal visitor has no reason to ask for a DLL in a Plugins folder.

Kind of threat

A server that handed out Amadey related files: two programs tagged dropped-by-amadey and four plugin DLLs (cred, cred64, clip, clip64)

Where the files were

hxxp://d-j-d[.]com/g84kfS5n/Uploads/ and hxxp://d-j-d[.]com/g84kfS5n/Plugins/: plain http on the normal web port

Domain registered

25 August 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com; status flags include client hold (RDAP, read 15 October 2026)

URLhaus entries

6 file addresses, all added on 15 October 2026; all 6 marked offline in our copy of the data

Our check

Our server could not resolve the name on 17 October 2026 (error ENOTFOUND), so no connection was made

Platform

Windows. MITRE describes Amadey as a Windows trojan bot. Nothing we read says these files affect Mac, iPhone or Android

What we checked on 17 October 2026, and what we could not

Our check was one plain request from our server (not a browser visit with a screenshot). It failed before any connection: the name d-j-d.com did not resolve. That is a fact about one moment, and it clears nothing.

What happened to d-j-d.com, from registration to our check

The domain is under two months old, and all six reports fall inside one afternoon. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 25 August 2026

   The domain is registered

   RDAP shows d-j-d.com registered on 25 August 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. We have no information about who registered it.

2. 15 October 2026, 14:58 UTC

   The first program is reported

   Bitsight reports build_amd.exe_Melted.exe in the Uploads folder, tagged dropped-by-amadey and 317106.

3. 15 October 2026, 15:37 to 15:38 UTC

   Four plugins are reported

   An anonymous reporter adds cred64.dll and clip64.dll at 15:37:12, cred.dll at 15:37:13 and clip.dll at 15:38:08, all tagged dll. Four files within one minute suggests someone ran a list of paths against the server in one go. That is our reading of the timestamps.

4. 15 October 2026, 16:12 UTC

   A second program is reported

   Bitsight reports inject-test.exe_Melted.exe, tagged dropped-by-amadey and f4d9f4. A file name that says test may mean the operator was still trying out a build; this is a reading of the name, not something a report states.

   

5. 17 October 2026

   Our check

   Our server cannot resolve d-j-d.com. All six entries are marked offline in our data. RDAP shows the status flags client delete prohibited, client hold, client renew prohibited, client transfer prohibited and client update prohibited.

What the pattern suggests, and what it does not: a young domain, a random folder name and a burst of reports that ends with the files offline is a common life cycle for a malware server. It does not tell us how many PCs asked for the files, because URLhaus does not count visitors.

What Amadey is

Amadey is a Windows trojan that works as a bot: it sits on a PC, reports to a server and does what the server tells it. The sources agree on the core and differ on details of each version.

What the cred and clip plugins do

The core of Amadey is a loader. The damage to a person usually comes from the add-ons, and two of them match the file names on d-j-d.com. Splunk and Picus describe them; the plugin files on this server were not opened by us.

1. 1

   The bot fetches a plugin from the server

   In the write-ups the plugins come as DLL files from a Plugins folder and are started by the Windows program rundll32.exe through an export called Main. A file that is a DLL sitting in a Plugins folder, as on d-j-d.com, fits that description.

2. 2

   cred: the credential stealer

   Splunk lists browsers it goes after, among them Chrome, Opera, Chromium, Vivaldi, Comodo, Orbitum, CocCoc and CentBrowser. Picus adds cryptocurrency wallet files, Telegram sessions and some documents from the Desktop. It sends what it finds to the same servers as the core bot.

3. 3

   clip: the clipboard clipper

   The clipper reads whatever you copy. Picus and others describe the aim as copied wallet addresses: when you copy an address to pay someone, the malware can swap in the attacker's address, so the money goes elsewhere. The clipboard also holds passwords that people copy from a manager, and the plugin sends what it reads to the server.

4. 4

   More programs follow

   MITRE says Amadey downloads and runs further malware. The two .exe files in the Uploads folder carry the tag dropped-by-amadey, so they may be such follow up programs. What they are, we do not know.

5. 5

   A caution about versions

   Parts of the public record are from 2022 and 2023, and the plugin set can change between versions. We cannot say that every PC that fetched these particular files lost every item listed below. We can say that the file names point to the credential and clipboard modules.

What this kind of malware can take from a Windows PC

The list below is what the named modules are reported to reach, not a record of what happened on any PC. Each item is named by at least one of the sources.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where Amadey ran and fetched these plugins.

• High

  Passwords and accounts

  Saved browser logins can be copied out in one run. Changing passwords from the infected PC does not help, because the new ones can be copied the same way.

• High

  Crypto sent to the wrong address

  A clipper changes the address you pasted. A transfer of crypto cannot be reversed, so check the first and last characters of an address on the confirmation screen before you send.

• High

  More malware on the same PC

  Amadey is a downloader. Whatever it fetched next may be more dangerous than the bot, and removing one file does not remove the rest.

• Medium

  Messaging and wallet sessions

  Picus names Telegram sessions and wallet files. A stolen session can let someone use an account without the password.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers and loaders are built to be quiet, and most victims notice nothing until an account is used. The signs below come from the sources and from what they imply; none is certain.

How a person ends up asking for these files

Nobody visits d-j-d.com on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are those that vendors link to Amadey in general.

1. 1

   Fake or cracked software

   Splunk and Picus describe Amadey spreading through installers that pose as real programs, cracks and key generators. We cannot tie any of this to d-j-d.com, but a download from a free software site is the most common story.

2. 2

   Phishing emails

   An attachment or a link that starts a script or an installer is a documented way to deliver Amadey. A file you did not expect, even from a known name, is the thing to avoid.

3. 3

   Another malware that drops it

   Amadey is itself a loader, and it is also dropped by other loaders. The tag dropped-by-amadey on the two programs says Amadey delivered them. It does not say what delivered Amadey.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact d-j-d.com, or did you run a cracked program, an unexpected installer or a file from an email around 15 October 2026 or earlier? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A bot needs the connection to send what it takes and to receive orders.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Look at Startup apps

   Open Settings > Apps > Startup. Look for names you did not install, and for programs with random letters as a name. Note the name before you switch anything off.

4. 4

   Look at the processes

   Press Ctrl + Shift + Esc to open Task Manager and stay on the Processes tab. Sort by CPU or by Memory, and look for programs with odd names or no description. Right-click one and choose Open file location to see where it lives. A program in a user AppData or Temp folder with a random name deserves suspicion, though presence is not proof and absence does not clear the PC.

5. 5

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for a detection named Amadey or for anything blocked or quarantined around the time of first contact. Microsoft says the results of an offline scan are also shown here.

6. 6

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check, and it shows whether anything has already been used.

7. 7

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a PC and no vendor publishes a removal procedure for this server's files, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags and every source we read describe a Windows threat. We found nothing that says the files on d-j-d.com affect anything else.