Amadey (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.amadey (Back to overview)

Amadey

URLhaus

Amadey is a botnet that appeared around October 2018 and is being sold for about 500$ on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.

References

2022-11-08 ⋅ AhnLab ⋅ ASEC
LockBit 3.0 Being Distributed via Amadey Bot
Amadey Gandcrab LockBit

2022-09-29 ⋅ Team Cymru ⋅ S2 Research Team
Seychelles, Seychelles, on the C(2) Shore: An overview of a bulletproof hosting provider named ELITETEAM.
Amadey Raccoon RedLine Stealer SmokeLoader STOP

2022-07-29 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team
SmokeLoader Malware Used to Augment Amadey Infostealer
Amadey SmokeLoader

2022-05-19 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
.NET Stubs: Sowing the Seeds of Discord (PureCrypter)
Aberebot AbstractEmu AdoBot 404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate

2022-04-20 ⋅ cocomelonc ⋅ cocomelonc
Malware development: persistence - part 1. Registry run keys. C++ example.
Agent Tesla Amadey BlackEnergy Cobian RAT COZYDUKE Emotet Empire Downloader Kimsuky

2022-03-31 ⋅ Trellix ⋅ John Fokker, Jambul Tologonov
Conti Leaks: Examining the Panama Papers of Ransomware
LockBit Amadey Buer Conti IcedID LockBit Mailto Maze PhotoLoader Ryuk TrickBot

2021-11-02 ⋅ Minerva ⋅ Natalie Zargarov
Underminer Exploit Kit: The More You Check The More Evasive You Become
Amadey Oski Stealer RedLine Stealer UnderminerEK

2021-09-06 ⋅ cocomelonc ⋅ cocomelonc
AV engines evasion for C++ simple malware: part 2
Agent Tesla Amadey Anchor Carbanak Carberp Cardinal RAT Felixroot Konni Loki Password Stealer (PWS) Maze Unidentified 090 (Lazarus)

2021-08-12 ⋅ Cisco Talos ⋅ Vanja Svajcer
Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT
Amadey Raccoon ServHelper

2021-07-08 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Harold Ogden
Amadey stealer plugin adds Mikrotik and Outlook harvesting
Amadey

2021-04-12 ⋅ PTSecurity ⋅ PTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader

2021-03-31 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
Quick Analysis of a Modular InfoStealer
Amadey

2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader KNOCKOUT SPIDER OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER

2021-02-09 ⋅ Max Kersten's Blog ⋅ Max Kersten
Ghidra script to decrypt strings in Amadey 1.09
Amadey

2021-02-01 ⋅ Microstep Intelligence Bureau ⋅ Microstep online research response team
Analysis of the attack activity organized by Konni APT using the topic of North Korean epidemic materials as bait
Amadey

2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP

2020-06-22 ⋅ CERT-FR ⋅ CERT-FR
Évolution De Lactivité du Groupe Cybercriminel TA505
Amadey AndroMut Bart Clop Dridex FlawedGrace Gandcrab Get2 GlobeImposter Jaff Locky Marap Philadephia Ransom QuantLoader Scarab Ransomware SDBbot ServHelper Silence tRat TrickBot

2020-03-26 ⋅ Telekom ⋅ Thomas Barabosch
TA505's Box of Chocolate - On Hidden Gems packed with the TA505 Packer
Amadey Azorult Clop FlawedGrace Get2 SDBbot Silence TinyMet TA505

2020-02-28 ⋅ Financial Security Institute ⋅ Financial Security Institute
Profiling of TA505 Threat Group That Continues to Attack the Financial Sector
Amadey Clop FlawedAmmyy Rapid Ransom SDBbot TinyMet

2020-02-05 ⋅ Cybereason ⋅ Lior Rochberger, Assaf Dahan
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar

2020-01-08 ⋅ Blackberry ⋅ Masaki Kasuya
Threat Spotlight: Amadey Bot Targets Non-Russian Users
Amadey

2019-04-27 ⋅ nao_sec ⋅ nao_sec
Analyzing Amadey
Amadey

2019-02-13 ⋅ KrabsOnSecurity ⋅ Mr. Krabs
Analyzing Amadey – a simple native malware
Amadey

2018-11-14 ⋅ Twitter (@0xffff0800) ⋅ 0xffff0800
Tweet on Amadey C2
Amadey

2018-11-13 ⋅ Twitter (@ViriBack) ⋅ Dee
Tweet on Amadey Malware
Amadey

Yara Rules

[TLP:WHITE] win_amadey_auto (20221125 | Detects win.amadey.)

rule win_amadey_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.amadey."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 890424 e8???????? 83ec04 8945fc 837dfc00 }
            // n = 5, score = 700
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   83ec04               | sub                 esp, 4
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   837dfc00             | cmp                 dword ptr [ebp - 4], 0

        $sequence_1 = { 8d85e8feffff 890424 e8???????? 8d85d8fdffff }
            // n = 4, score = 700
            //   8d85e8feffff         | lea                 eax, [ebp - 0x118]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   8d85d8fdffff         | lea                 eax, [ebp - 0x228]

        $sequence_2 = { e8???????? 84c0 7407 c745fc07000000 }
            // n = 4, score = 700
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7407                 | je                  9
            //   c745fc07000000       | mov                 dword ptr [ebp - 4], 7

        $sequence_3 = { 8d85e8feffff 890424 e8???????? c70424???????? e8???????? 89442404 8d85e8feffff }
            // n = 7, score = 700
            //   8d85e8feffff         | lea                 eax, [ebp - 0x118]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   c70424????????       |                     
            //   e8????????           |                     
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   8d85e8feffff         | lea                 eax, [ebp - 0x118]

        $sequence_4 = { e8???????? c7442404???????? c70424???????? e8???????? 89442408 c744240401000000 }
            // n = 6, score = 700
            //   e8????????           |                     
            //   c7442404????????     |                     
            //   c70424????????       |                     
            //   e8????????           |                     
            //   89442408             | mov                 dword ptr [esp + 8], eax
            //   c744240401000000     | mov                 dword ptr [esp + 4], 1

        $sequence_5 = { 89e5 83ec08 c745fc00000000 e8???????? }
            // n = 4, score = 700
            //   89e5                 | mov                 ebp, esp
            //   83ec08               | sub                 esp, 8
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   e8????????           |                     

        $sequence_6 = { 890424 e8???????? 8d85d8fdffff 890424 e8???????? 8b4508 }
            // n = 6, score = 700
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   8d85d8fdffff         | lea                 eax, [ebp - 0x228]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]

        $sequence_7 = { 8d85e8feffff 890424 e8???????? 0fb6c0 }
            // n = 4, score = 700
            //   8d85e8feffff         | lea                 eax, [ebp - 0x118]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   0fb6c0               | movzx               eax, al

        $sequence_8 = { 8d85f8fdffff 890424 e8???????? c744240800020000 c744240400000000 8d85f8fbffff 890424 }
            // n = 7, score = 700
            //   8d85f8fdffff         | lea                 eax, [ebp - 0x208]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   c744240800020000     | mov                 dword ptr [esp + 8], 0x200
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0
            //   8d85f8fbffff         | lea                 eax, [ebp - 0x408]
            //   890424               | mov                 dword ptr [esp], eax

        $sequence_9 = { e8???????? 89442404 8d85e8fdffff 890424 e8???????? c7042401000000 }
            // n = 6, score = 700
            //   e8????????           |                     
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   8d85e8fdffff         | lea                 eax, [ebp - 0x218]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   c7042401000000       | mov                 dword ptr [esp], 1

    condition:
        7 of them and filesize < 264192
}

Download all Yara Rules

Amadey Propose Change

References

Yara Rules

Amadey