(Cylance) Amadey is a simple Trojan bot first discovered in October of 2018. It is primarily used for collecting information on a victim's environment, though it can also deliver other malware. A major infection vector for Amadey are exploit kits such as RigEK and Fallout EK. During our monitoring, we also observed this Trojan being delivered via AZORult Infostealer on February 23rd to March 1st, and April 18th to June 5th. The sample hash values were not changed frequently. Recently, TA505 used Amadey for their campaign in April 2019.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|---|
| 185.172.128.100:80 | 2023-12-01 |
| 69.197.161.106:80 | 2023-12-01 |
| 185.172.128.19:80 | 2023-12-01 |
| 5.42.66.9:80 | 2023-12-01 |
| 185.196.8.176:80 | 2023-12-01 |
| 167.235.20.126:80 | 2023-11-30 |
| 193.42.33.7:80 | 2023-11-17 |
| 85.209.11.199:80 | 2023-11-12 |
| 77.91.97.162:80 | 2023-11-12 |
| 5.42.65.28:80 | 2023-11-01 |
| Domain | Timestamp |
|---|---|
| panel.ceo-reputation.ru | 2023-11-26 |
| ceo-reputation.ru | 2023-11-26 |
| brodoyouevenlift.co.za | 2023-12-01 |
| tceducn.com | 2023-12-01 |
| shohetrc.com | 2023-12-01 |
| atillapro.com | 2023-12-01 |
| cncdevelopment.org | 2023-11-07 |
| cncdevelopment.boo | 2023-11-02 |
| xyl.lat | 2023-10-09 |
| smz.sh | 2023-08-14 |
| URL | Timestamp |
|---|---|
| http://185.172.128.19/ghsdh39s/index.php | 2023-11-29 |
| http://brodoyouevenlift.co.za/g9sdjScV2/Login.php | 2023-11-21 |
| http://185.172.128.19/ghsdh39s/Login.php | 2023-11-20 |
| http://0-9u210edu12j-dj-1.xyz/g9smksXla/Login.php | 2023-11-20 |
| http://185.196.8.176/7jshasdS/Login.php | 2023-11-20 |
| http://167.235.20.126/bjdm32DP/Login.php | 2023-11-20 |
| http://193.42.33.7/mbSDvj3/Login.php | 2023-11-20 |
| http://77.91.97.162/g93kdwj3S/Login.php | 2023-11-20 |
| http://kbond2024.org/g9sdjScV2/Login.php | 2023-11-20 |
| http://69.197.161.106/g9sdjScV2/Login.php | 2023-11-20 |
2023-11-19 by Embee_research from Twitter (@embee_research)
2023-11-02 by BitSight from BitSight
2023-11-02 by BitSight from BitSight
2023-08-31 by Natalie Zargarov from Rapid7 Labs
2023-08-10 by Muhammad Hasan Ali from Github (muha2xmad)
2023-08-10 by Muhammad Hasan Ali from Github (muha2xmad)
2023-07-25 by Splunk Threat Research Team from splunk
2023-06-08 by Embee_research from Twitter (@embee_research)
2023-05-19 by Embee_research from Twitter (@embee_research)
2023-05-01 by Check Point Research from Check Point Research
2023-04-12 by Spamhaus Malware Labs from Spamhaus
2023-04-10 by Matthew from Twitter (@embee_research)
2023-01-27 by The Cyber Express from cyble
2023-01-25 by Cyble from cyble
2022-12-22 by Sanseo from AhnLab
2022-11-08 by ASEC from AhnLab
2022-09-29 by S2 Research Team from Team Cymru
2022-07-29 by BlackBerry Research & Intelligence Team from Blackberry
2022-07-21 by ASEC from AhnLab
2022-05-19 by The BlackBerry Research & Intelligence Team from Blackberry
2022-04-20 by cocomelonc from cocomelonc
2022-03-31 by John Fokker from Trellix
2021-11-02 by Natalie Zargarov from Minerva
2021-09-06 by cocomelonc from cocomelonc
2021-08-12 by Vanja Svajcer from Cisco Talos
2021-07-08 by Jason Reaves from Medium walmartglobaltech
2021-04-12 by PTSecurity from PTSecurity
2021-03-31 by Xavier Mertens from InfoSec Handlers Diary Blog
2021-02-23 by CrowdStrike from CrowdStrike
2021-02-09 by Max Kersten from Max Kersten's Blog
2021-02-01 by Microstep online research response team from Microstep Intelligence Bureau
2021-01-18 by Benoît Ancel from Medium csis-techblog
2020-06-22 by CERT-FR from CERT-FR
2020-03-26 by Thomas Barabosch from Telekom
2020-02-28 by Financial Security Institute from Financial Security Institute
2020-02-05 by Lior Rochberger from Cybereason
2020-01-08 by Masaki Kasuya from Blackberry
2019-04-27 by nao_sec from nao_sec
2019-02-13 by Mr. Krabs from KrabsOnSecurity
2018-11-14 by 0xffff0800 from Twitter (@0xffff0800)
2018-11-13 by Dee from Twitter (@ViriBack)
Tool: Amadey
Names: Amadey
Description: (Cylance) Amadey is a simple Trojan bot first discovered in October of 2018. It is primarily used for collecting information on a victim's environment, though it can also deliver other malware. A major infection vector for Amadey are exploit kits such as RigEK and Fallout EK. During our monitoring, we also observed this Trojan being delivered via AZORult Infostealer on February 23rd to March 1st, and April 18th to June 5th. The sample hash values were not changed frequently. Recently, TA505 used Amadey for their campaign in April 2019.
Category: Malware
Type: Reconnaissance, Dropper
Information: https://threatvector.cylance.com/en_us/home/threat-spotlight-amadey-bot.html
Information: https://krabsonsecurity.com/2019/02/13/analyzing-amadey-a-simple-native-malware/
Mitre-attack: https://attack.mitre.org/software/S1025/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:amadey
Last-card-change: 2022-12-30
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1106 NATIVE API amadey has used a variety of windows api calls, including getcomputernamea, getusernamea, and createprocessa. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER amadey has changed the startup folder to the one containing its executable by overwriting the registry keys. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER amadey has changed the startup folder to the one containing its executable by overwriting the registry keys. | T1027 OBFUSCATED FILES OR INFORMATION amadey has obfuscated strings such as antivirus vendor names, domains, files, and others. T1553.005 SUBVERT TRUST CONTROLS : MARK-OF-THE-WEB BYPASS amadey has modified the :zone.identifier in the ads area to zero. | T1083 FILE AND DIRECTORY DISCOVERY amadey has searched for folders associated with antivirus software. T1518.001 SOFTWARE DISCOVERY : SECURITY SOFTWARE DISCOVERY amadey has checked for a variety of antivirus products. T1082 SYSTEM INFORMATION DISCOVERY amadey has collected the computer name and os version from a compromised machine. T1614 SYSTEM LOCATION DISCOVERY amadey does not run any tasks or install additional malware if the victim machine is based in russia. T1033 SYSTEM OWNER/USER DISCOVERY amadey has collected the user name from a compromised host using getusernamea. | T1105 INGRESS TOOL TRANSFER amadey can download and execute files to further infect a host machine with additional malware. |