Loading malware…
Amadey is a modular Windows malware loader and information stealer first observed in late 2018. Sold through underground cybercrime markets and used in pay-per-install operations, it profiles compromised systems, communicates with command-and-control infrastructure, and downloads and executes additional payloads. It provides an initial-access foundation for information stealers, remote-access trojans, proxy malware, and ransomware. Delivered families include StealC, VectraRAT, SeroRAT, and Socks5Systemz; Amadey has also been associated with TA505 activity and LockBit-related operators.
Amadey collects operating-system and architecture information, computer and user names, domain membership, administrator status, and installed antivirus information. Its plugin ecosystem extends functionality to credential collection from browsers, cryptocurrency wallets, and applications, as well as screenshot capture, clipboard monitoring, and proxying. Collected information is transmitted to command-and-control servers. Observed versions use HTTP POST communications, while later versions encrypt check-in data and server responses with RC4 and encode the results as hexadecimal strings.
Observed samples establish persistence through scheduled tasks and changes to the user Startup-folder configuration. They can request administrative execution, restrict permissions on installed files to impede removal, and decode configuration strings at runtime. Amadey samples have also been protected with third-party packers.
Distribution includes phishing emails, pirated software bundles, exploitation, and deployment by other malware. ClickFix campaigns have delivered Amadey through fake Windows update prompts on counterfeit adult websites promoted through malvertising. Campaigns exploiting CVE-2023-7028 in self-hosted GitLab environments have used Amadey to distribute StealC.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Exploitation de CVE-2023-7028 (GitLab) pour distribuer StealC via le loader Amadey. | « Exploitation de CVE-2023-7028 (GitLab) pour distribuer StealC via le loader Amadey. »
We have also seen instances of Amaday C&C servers recently that are actively pushing DoublePulsar backdoor and EternalBlue exploit payloads on the victim machine. | One such threat we've kept an eye on is Amadey, a bot of Russian origin, which was first seen in late 2018. Once on a victim's machine, Amadey sends user data to a Command and Control (C&C) server and executes other tasks sent back by the C&C server.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Amadey is a modular Trojan bot and malicious loader first identified in late 2018, targeting Windows operating systems. The analyzed sample communicates its Amadey version (3.50) and ID to C2 infrastructure.
TA406 has used many different malware families, including KONNI, SANNY, CARROTBAT/CARROTBALL, BabyShark, Amadey and Android Moez.
The Amadey bot is a Trojan that was first discovered in 2018 and is used to steal sensitive information from the infected device.
During our analysis of the ROKRAT infection chain, we came across a similar chain leading to the deployment of Amadey, a commercial RAT sold in underground forums.
During our analysis of the ROKRAT infection chain, we came across a similar chain leading to the deployment of Amadey, a commercial RAT sold in underground forums.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : Amadey (loader/bot)
17 distinct techniques documented for this family, organized by ATT&CK tactic.
1,135 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as malware used as a loader or additional component in campaigns introducing DarkVision. The reference does not detail its individual execution chain.
Named malware distributed through infrastructure targeted by a previous Microsoft disruption. Its capabilities are not described in this reference.
Loader utilisé pour distribuer le stealer StealC dans la chaîne décrite.
Loader used to deploy the StealC infostealer in campaigns targeting vulnerable self-hosted GitLab instances.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.