Tool: Amadey| Names | Amadey | |
| Category | Malware | |
| Type | Reconnaissance, Dropper | |
| Description | (Cylance) Amadey is a simple Trojan bot first discovered in October of 2018. It is primarily used for collecting information on a victim's environment, though it can also deliver other malware. A major infection vector for Amadey are exploit kits such as RigEK and Fallout EK. During our monitoring, we also observed this Trojan being delivered via AZORult Infostealer on February 23rd to March 1st, and April 18th to June 5th. The sample hash values were not changed frequently. Recently, TA505 used Amadey for their campaign in April 2019. | |
| Information | <https://threatvector.cylance.com/en_us/home/threat-spotlight-amadey-bot.html> <https://krabsonsecurity.com/2019/02/13/analyzing-amadey-a-simple-native-malware/> | |
| Malpedia | <https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey> | |
| AlienVault OTX | <https://otx.alienvault.com/browse/pulses?q=tag:amadey> | |
Last change to this tool card: 13 May 2020
Download this tool card in JSON format
| Changed | Name | Country | Observed | ||
APT groups | |||||
| FIN11 | [Unknown] | 2016-Oct 2020  | |||
 | TA505, Graceful Spider, Gold Evergreen |  | 2006-Oct 2020 |  | |
2 groups listed (2 APT, 0 other, 0 unknown)
|
Thailand Computer Emergency Response Team (ThaiCERT) Follow us on
|
Report incidents |
|
 |
+66 (0)2-123-1234 | |
 |
report@thaicert.or.th | |
 |
Download PGP key | |