Amadey

A significant increase in the percentage of malicious scripts and phishing pages was driven by a recent series of widespread phishing attacks in August and September. The phishing lures were distributed through various channels, including phishing emails (e.g., fake vulnerability notifications claiming to be from GitHub), malicious links, and malvertising networks.

The phishing lures were distributed through various channels, including phishing emails (e.g., fake vulnerability notifications claiming to be from GitHub), malicious links, and malvertising networks.

Process 4192 runs a command that will start a scheduled task called “GoogleUpdateTaskMachineQC” using schtasks ... (T1053.005 – Scheduled Task/Job: Scheduled Task).

Threat actors are increasingly using PowerShell to execute malware, including crypto miners, by embedding malicious code directly into command line arguments.

The instructions provided by the phishing scripts tricked users into executing malicious PowerShell commands to download additional spyware... Nowadays, threat actors are increasingly using PowerShell to execute malware, including crypto miners, by embedding malicious code directly into command line arguments.

Talos discovered another unique file on the “Milidmdds” GitHub account during this research — a malicious Python script named “checkbalance.py”.

Clicking the “I’m not a robot” button copies the line powershell.exe -eC ... to the clipboard and displays so-called “verification steps”: Press Win + R; Press CTRL + V; Press Enter.

These scripts are designed to trick users into following simple instructions on their computers, which ultimately trigger the download of next-stage malware – either the Lumma stealer or the Amadey Trojan.

The instructions provided by the phishing scripts tricked users into executing malicious PowerShell commands to download additional spyware.

Process 4192 runs a command that will start a scheduled task called “GoogleUpdateTaskMachineQC” using schtasks ... (T1053.005 – Scheduled Task/Job: Scheduled Task).

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Persistence may be achieved by adding a program to a startup folder, which causes the referenced program to be executed upon log-in (T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder).

Process 4192 runs a command that will start a scheduled task called “GoogleUpdateTaskMachineQC” using schtasks ... (T1053.005 – Scheduled Task/Job: Scheduled Task).

Persistence may be achieved by adding a program to a startup folder, which causes the referenced program to be executed upon log-in (T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder).

The line from the clipboard contains a Base64-encoded PowerShell command... Inside this content is an obfuscated PowerShell script...

Talos identified Emmenhtal samples masquerading as MP4 files.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Both Lumma and Amadey are designed to steal credentials from browsers and password managers.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

Amadey’s primary functions are to collect system information and download secondary payloads on an infected host.

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

Lumma... searches the victim’s device for files associated with various cryptocurrency wallets and steals them... Then, the attackers view browser extensions related to wallets and cryptocurrencies and steal data from them.

These plugins come in the form of dynamic link libraries (DLLs) that can be selected based on desired functionality, such as screenshot capabilities or credential harvesting.

After execution, this payload contacts “hxxp://185[.]215[.]113[.]43/Zu7JuNko/index.php”, a known Amadey C2 address.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

These scripts are designed to trick users into following simple instructions on their computers, which ultimately trigger the download of next-stage malware – either the Lumma stealer or the Amadey Trojan.

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.