AmadeyMalware
Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.From MISP Galaxy
Last reported 4 months ago, by ESET WeLiveSecurity (ES)6 reports
ATT&CK techniques
6 of 78 · each with the sentence it comes from- T1055Process Injection
“T1055 Process Injection”
- T1005Data from Local System
“T1005 Data from Local System”
- T1012Query Registry
“T1012 Query Registry”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1033System Owner/User Discovery
“T1033 System Owner/User Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
ESET participa en la Operación Endgame para interrumpir la botnet Amadey y el infostealer Stealc“ESET participa en la Operación Endgame para interrumpir la botnet Amadey y el infostealer Stealc”
-
ESET takes part in Operation Endgame to disrupt Amadey and Stealc“ESET takes part in Operation Endgame to disrupt Amadey and Stealc”
-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“During this period, ClearFake delivered loader malware to Windows systems, including Amadey, IDAT Loader, and HIjack Loader.”
-
WebDAV-as-a-Service: The Infrastructure Behind Emmenhtal“Over 100 WebDAV servers delivered a wide range of payloads including DarkGate, Amadey, Lumma, Remcos and many others.”
-
BLISTER Loader“…o LockBit ransomware and the SocGholish framework; in addition, Elastic has also observed BLISTER in relation to the following families: Amadey, BitRAT, Clipbanker, Cobalt Strike, Remcos, and Raccoon along with others.”
-
Package deal: Malware bundles causing disruption and damage across EMEA“In addition to these two widely-used stealers, the malware bundles also contained the lesser-known Amadey stealer.”
Indicators in its reports
named in the reports above- flare[.]ioin 2 reports
- 11a42ef076686cb2…943652a5aadcin 2 reports
- 32d0c3300825b0bb…44f0ad2da989in 2 reports
- 5f3f99b14243404c…1244cce394bfin 2 reports
- b4101027bf2f1261…b016ce249037in 2 reports
- f61e3a643f2417e1…fc8a7cb96756in 2 reports
- 09002d4668a77885…e421c0628357in 2 reports
Copy these 7 indicators · defanged
Thanks — we review every report.