Amadey Bot Malware Being Distributed Through SmokeLoader and other campaigns

guest · Jul 24, 2022

Amadey malware pushed via software cracks in SmokeLoader campaign
July 24, 2022

A new version of the Amadey Bot malware is distributed through the SmokeLoader malware, using software cracks and keygen sites as lures.

Amadey Bot is a malware strain discovered four years ago, capable of performing system reconnaissance, stealing information, and loading additional payloads.
Click to expand...

While its distribution has faded after 2020, Korean researchers at AhnLab report that a new version has entered circulation and is supported by the equally old but still very active SmokeLoader malware.
New Amadey campaign
SmokeLoader is downloaded and executed voluntarily by the victims, masked as a software crack or keygen. As it is common for cracks and key generators to trigger antivirus warnings, it is common for users to disable antivirus programs before running the programs, making them an ideal method of distributing malware.

Upon execution, it injects "Main Bot" into the currently running (explorer.exe) process, so the OS trusts it and downloads Amadey on the system.
Click to expand...

In its latest version, number 3.21, Amadey can discover 14 antivirus products and, presumably based on the results, fetch payloads that can evade those in use.

The server responds with instructions on downloading additional plugins in the form of DLLs, as well as copies of additional info-stealers, most notably, RedLine ('yuri.exe').
Click to expand...

AhnLab: Amadey Bot Being Distributed Through SmokeLoader

Amadey Bot, a malware that was first discovered in 2018, is capable of stealing information and installing additional malware by receiving commands from the attacker. Like other malware strains, it has been sold in illegal forums and used by various attackers.

The ASEC analysis team previously revealed cases where Amadey was used on attacks in the ASEC blog posted in 2019 (English version unavailable). Amadey was mainly used to install ransomware by attackers of GandCrab or to install FlawedAmmyy by the TA505 group that is infamous for Clop ransomware. The attackers of Fallout Exploit Kit and Rig Exploit Kit are also known for using Amadey.
Click to expand...

guest · Nov 10, 2022

LockBit affiliate uses Amadey Bot malware to deploy ransomware
By Bill Toulas @billtoulas - November 8, 2022

A LockBit 3.0 ransomware affiliate is using phishing emails that install the Amadey Bot to take control of a device and encrypt devices.

According to a new AhnLab report, the threat actor targets companies using phishing emails with lures pretending to be job application offers or copyright infringement notices.
The LockBit 3.0 payload used in this attack is downloaded as an obfuscated PowerShell script or executable form, running on the host to encrypt files.
Click to expand...

Infection chains
AhnLab researchers noticed two distinct distribution chains, one relying on a VBA macro inside a Word document and one disguising the malicious executable as a Word file.
The second case, seen in late October, uses email attachments with a file named "Resume.exe" (Amadey) that uses a Word document icon, tricking recipients into double-clicking.

Both distribution paths lead to Amadey infections that use the same command and control (C2) address, so it's safe to assume the operator is the same.
Click to expand...

AhnLab: LockBit 3.0 Being Distributed via Amadey Bot

The ASEC analysis team has confirmed that attackers are using Amadey Bot to install LockBit. Amadey Bot, a malware that was first discovered in 2018, is capable of stealing information and installing additional malware by receiving commands from the attacker. Like other malware strains, it is being sold in illegal forums and still being used by various attackers.

It was used in the past to install ransomware by attackers of GandCrab or to install FlawedAmmyy by the TA505 group which is infamous for Clop ransomware. Recently, it was distributed under the disguise of a popular Korean messenger app.
Click to expand...

Amadey Bot, the malware that is used to install LockBit, is being distributed through two methods: one using a malicious Word document file, and the other using an executable that takes the disguise of the Word file icon.
Click to expand...

Log in or Sign up

Amadey Bot Malware Being Distributed Through SmokeLoader and other campaigns

guest Guest

guest Guest

Log in or Sign up

Amadey Bot Malware Being Distributed Through SmokeLoader and other campaigns

guest Guest

guest Guest

Useful Searches