Amadey Malware: How the Loader Works and How to Find It

In one minute

What it is

A modular loader sold as malware-as-a-service. Microsoft says threat actors use it to deliver StealC and other malware, and ESET says its main job is to distribute further malware to victims.

What it does

The bot registers the PC with a control server over HTTP, then runs the tasks it receives. These include downloading and running files, running commands, stealing credentials and clipboard data, and opening remote access.

Who uses it

Attributed by MITRE to Kimsuky and TA505. Microsoft says Secret Blizzard used Amadey infections to deploy custom malware against targets in Ukraine. The service itself is sold to many affiliates.

How it gets in

ESET telemetry shows fake software updates, cracked software installers and other malware loaders. India's Cyber Swachhta Kendra also lists phishing emails.

What to do first

Treat a PC that ran Amadey as exposed. Reset the logins and sessions it held, then hunt for its persistence and for the other malware it fetched.

Names

Public sources use several names for this malware.

What it can do

The ATT&CK techniques the cited sources map to this tool, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Detection and defense

1. Treat the PC's logins as stolen

   Microsoft says an infostealer on one device can yield VPN logins, SSO tokens and session cookies that bypass MFA, and that Amadey is used to deliver such stealers. It points to identity protection, credential hygiene and rapid response. Reset passwords and end sessions for everything the PC could reach.^{[2, 3]}

   Counters: T1555.003

2. Hunt for persistence

   Microsoft's sample copied itself to nudwee.exe in a folder named e079729711 under the user profile or %TEMP% and created a scheduled task. MITRE lists Run key and Startup folder changes. Other samples may use other names, so look for the pattern as well.^{[1, 2, 3]}

   Counters: T1547.001 T1112

3. Look for what it dropped

   Microsoft names StealC, Lumma Stealer, remote access trojans, miners and sometimes ransomware as Amadey payloads. ESET says its largest cluster delivered about 14 payloads per victim. Scan for all of them, not only Amadey. Microsoft Defender detection names include Trojan:Win32/Amadey, Trojan:Win64/Amadey and TrojanDownloader:Win32/Amadey.^{[2, 3]}

   Counters: T1105

4. Check for new accounts and remote access

   Amadey tasks can create a hidden local administrator account, enable RDP and install VNC. Microsoft Defender alerts include a user account created under suspicious circumstances and a group added suspiciously.^{[2, 3]}

   Counters: T1136.001 T1219.002

5. Watch the beacon

   Microsoft says the first thing the bot sends is a status check, "st=s", in an HTTP POST request, and later data goes out in encrypted POST requests. Search proxy and EDR logs for it, and check traffic against the control servers in the Microsoft and ESET indicator lists. India's alert advises monitoring traffic to the listed domains and IPs.^{[2, 3, 6]}

   Counters: T1071.001

6. Close the way in

   ESET and India's Cyber Swachhta Kendra both point to cracked software, fake updates and trojanized installers. India's alert advises limited-privilege users and application whitelists. Microsoft advises cloud-delivered protection, SmartScreen, tamper protection and attack surface reduction rules.^{[2, 3, 6]}

   Counters: T1204.002