1. Home
  2. Software
  3. Amadey

Amadey

Amadey is a Trojan bot that has been used since at least October 2018.[1][2]

ID: S1025
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 14 July 2022
Last Modified: 07 May 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

Amadey can collect information from a compromised host.[2]
Enterprise T1112 修改注册表

Amadey has overwritten registry keys for persistence.[2]
Enterprise T1568 .001 动态解析: Fast Flux DNS

Amadey has used fast flux DNS for its C2.[1]
Enterprise T1140 反混淆/解码文件或信息

Amadey has decoded antivirus name strings.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.[1][2]
Enterprise T1071 .001 应用层协议: Web Protocols

Amadey has used HTTP for C2 communications.[2]
Enterprise T1083 文件和目录发现

Amadey has searched for folders associated with antivirus software.[1]
Enterprise T1106 本机API

Amadey has used a variety of Windows API calls, including GetComputerNameA, GetUserNameA, and CreateProcessA.[2]
Enterprise T1027 混淆文件或信息

Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.[2]
Enterprise T1614 系统位置发现

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.[2]
Enterprise T1082 系统信息发现

Amadey has collected the computer name and OS version from a compromised machine.[1][2]
Enterprise T1033 系统所有者/用户发现

Amadey has collected the user name from a compromised host using GetUserNameA.[2]
Enterprise T1016 系统网络配置发现

Amadey can identify the IP address of a victim machine.[2]
Enterprise T1518 .001 软件发现: Security Software Discovery

Amadey has checked for a variety of antivirus products.[1][2]
Enterprise T1105 输入工具传输

Amadey can download and execute files to further infect a host machine with additional malware.[2]
Enterprise T1041 通过C2信道渗出

Amadey has sent victim data to its C2 servers.[2]
Enterprise T1553 .005 颠覆信任控制: Mark-of-the-Web Bypass

Amadey has modified the :Zone.Identifier in the ADS area to zero.[1]

Groups That Use This Software

ID Name References
G0094 Kimsuky

[3]
G0092 TA505

[1][2]

References

  1. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  2. Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.
  1. Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.