Loading malware…
Amadey Bot is a Windows malware family first observed in 2018 and widely used as a modular bot and malware delivery platform. It is sold in criminal forums and has been used by multiple threat actors, including in campaigns associated with ransomware deployment. Amadey is capable of collecting host information, enumerating installed security products, establishing persistence, and retrieving additional payloads from command-and-control infrastructure. Documented activity shows it being used to deliver other malware families, including LockBit, and to support broader intrusion chains alongside information stealers such as Lumma Stealer.
Amadey commonly installs itself into temporary user-accessible locations, enforces execution from an expected installed path, and uses mutex logic to prevent multiple concurrent instances. Persistence has been observed through scheduled tasks configured to relaunch the malware at frequent intervals. Its network communications include HTTP POST-based exchanges that transmit basic victim metadata and receive tasking from the operator. Recovered command structures and plugin references indicate a loader-oriented design in which the bot can download and execute additional malware on demand.
Analysis of samples has shown functionality consistent with reconnaissance and post-compromise staging, including collection of system details and antivirus product enumeration. Operational reporting also attributes information-stealing capability to Amadey, although its most consistently documented role is as a downloader or loader within multi-stage attacks. In ransomware campaigns, Amadey has been used after user execution of malicious documents or disguised executables, then persisted locally, contacted its controller, and fetched follow-on payloads for execution.
Observed delivery methods include phishing emails, malicious document lures using external-template and macro chains, and deceptive executables masquerading as benign files or software. Campaign reporting also notes use against enterprise targets, including companies in Korea and manufacturing organizations. Infrastructure hunting research has identified recurring server-side fingerprints associated with Amadey command-and-control nodes, indicating operators sometimes reuse web content and certificate characteristics across clusters.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The ASEC analysis team has confirmed that attackers are using Amadey Bot to install LockBit. Amadey Bot, a malware that was first discovered in 2018, is capable of stealing information and installing additional malware by receiving commands from the attacker.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
malware disguised as a KakaoTalk installation file (KakaoTalkUpdate.zip etc.) is being distributed via email.
The e-mail used in the attack has not been confirmed yet, but the file was run as “Resume.exe.” It was also disguised as an innocuous Word file icon and created by a compression program. Judging from its characteristics above, it appears that Amadey was installed via an e-mail attachment.
Amadey that is run through the process above copies itself into the Temp directory, registers to the task scheduler and allows it to run even after a reboot.
The LNK file is a downloader that runs powershell command to download and run Amadey.
before executing the following command. cmd.exe /c rundll32.exe “C:\users\public\srms.dat” Run cmd.exe /C timeout /t 5 /nobreak & Del /f /q “C:\Users\[Username]\Desktop\kakaotalk_update.exe”
As an external Word file, it downloads a Word file that contains a malicious VBA macro from the following URL when run.
This revealed a very area of high entropy within the file. This is a strong indication that the file is a packed loader and not the final payload.
This malware has the same filename and icon as the actual messenger program, which prompts ordinary users to launch it.
Upon initial execution of the kakaotalk_update.exe malware which is seen to have been attached to emails, it runs recursion on the process and injects itself into the process.
cmd.exe /C timeout /t 5 /nobreak & Del /f /q “C:\Users\[Username]\Desktop\kakaotalk_update.exe” ... then deletes itself.
We decided to investigate the string decryption using X32dbg... Eventually, the constant breakpoint + execute until the return combination got tiring... This revealed some c2 information.
cmd.exe /c rundll32.exe “C:\users\public\srms.dat” Run ... Afterward, using rundll32.exe, it creates and runs the AmadeyBot with the filename “tapi32.dll”
At a location of 003e9870 - was a function responsible for checking the location of the current running file. If the location did not match C:\users\<user>\appdata\local\temp\595f021478\oneetx.exe - then the malware would terminate... If the mutex creation returned a value of 0xb7 (Already Exists) - then the malware would terminate itself.
Eventually, it eventually returned a value of Startup... Hitting again revealed a registry path of SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Practical queries for identifying malware infrastructure with FOFA.
the executed Amadey Bot transmits information from the user PC including the infected system’s ID, Amadey version, admin privilege status, architecture, Windows version, PC name, and username to the C2 server.
downloads a zip file with additional compressed malware to a shared folder path
At a location of 003e9870 - was a function responsible for checking the location of the current running file. If the location did not match C:\users\<user>\appdata\local\temp\595f021478\oneetx.exe - then the malware would terminate... If the mutex creation returned a value of 0xb7 (Already Exists) - then the malware would terminate itself.
In the original post on Amadey bot, conditional breakpoints were used to extract decrypted strings and obtain the address of a command and control (C2) server.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet and information stealer malware that establishes persistence and is used to harvest credentials and system information, often as a precursor to ransomware or extortion.
Used in conjunction with Lumma Stealer and also described as one of the malware families that can deliver Lumma as a secondary payload.
Bot/loader malware whose infrastructure in this example was identified by combining HTTP response body patterns with ASN/location filtering.
Bot malware family whose infrastructure can be identified here through re-used certificate values.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.