Amadey Info-Stealer

Overview

• Name: Amadey Info-Stealer
• First Discovered: October 2018
• Primary Functionality: Steals sensitive information, installs additional malware, and communicates with C2 (Command and Control) servers for further instructions.
• Distribution: Often spread via SmokeLoader campaigns, which infect systems through cracked software.

Key Components

Amadey Bot: Malware capable of:

• Stealing information from infected devices.
• Installing additional malware on command from attackers.
• Reducing detection by limiting data exfiltration volume.

SmokeLoader:

• Malware Loader that injects malicious payloads into Windows Explorer processes.
• Used to download and execute Amadey on compromised devices.

Objective

• Primary Goals: Data theft and further malware distribution.
• Evading Detection: By minimizing data exfiltration volumes to avoid triggering security defenses.

Kill Chain Timeline

1. Initial Intrusion:

• Entry through phishing links or cracked software leading to Amadey download.
• Utilizes N-day exploits (known vulnerabilities) via SmokeLoader.

2. Unusual Outbound Connections:

• Amadey captures network screenshots.
• Sends data to C2 server via HTTP POST requests targeting .php URIs.

3. C2 Communications:

Frequent C2 connections for instructions to:

• Download DLLs and additional info-stealers like RacoonStealer.
• Beaconing activity and connections to rare or suspicious external hosts.

4. Internal Reconnaissance & File Download:

• Malicious executables, DLLs, and configuration files downloaded to exfiltrate data.

5. Data Exfiltration:

Stolen data sent to rare IPs via HTTP POST/GET requests.

Uses low-volume HTTP connections to evade detection.

==> Anomalous Connection Patterns:

• HTTP POST requests without hostnames.
• Multiple HTTP POSTs to unusual PHP endpoints.
• Low and slow connections reduce the risk of triggering detection.

Bypassing Security

• Tactic: Uses low-volume, “low and slow” HTTP exfiltration, minimizing detection by avoiding large data uploads.
• Typical Detection Avoidance: Traditional security tools often focus on large data transfers, allowing small-volume, frequent transfers to slip through.

Key Terms

• Zero-Day Vulnerability: A software flaw unknown to the vendor and unpatched.
• N-Day Vulnerability: A known, patch-available vulnerability left unpatched by organizations, often exploited by Amadey.

Threat Landscape Impact

• Malware-as-a-Service (MaaS): Amadey’s prevalence across multiple environments underscores the persistence of MaaS and info-stealers in today’s threat landscape.

For more information, please check :

• https://darktrace.com/fr/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities
• https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
• https://asec.ahnlab.com/en/41450/
• https://asec.ahnlab.com/en/36634/