Cyble Research and Intelligence Labs document a rising Amadey bot campaign spreading via phishing sites and spam, acting as a downloader and loader for additional malware while stealing browser data and crypto wallet information. The campaign employs persistence mechanisms, C2 communications, and modular loading (cred64.dll and clip64.dll) to execute and exfiltrate data. #AmadeyBot #LOCKBIT #CybleResearch #Cred64 #Clip64 #SeilExe #BrowserDataTheft
Keypoints
- The Amadey bot has reemerged, with increased sample counts in Q4-2022, indicating active use by threat actors to drop other malware.
- Infection now occurs via phishing sites (in addition to spam emails), where a site mimics Game Cheat and downloads a Bossmenu Setup.rar payload.
- A loader file named Seil.exe drops from the downloaded archive and downloads the Amadey bot from a remote server.
- The Amadey bot uses persistence mechanisms (registry startup value and Task Scheduler) to run on user login and at short intervals.
- Credential stealing occurs via Cred64.dll, targeting Local State and Login Data across multiple browsers, with data exfiltrated to a C2 server.
- The Clip64.dll module acts as a clipper, intercepting and replacing cryptocurrency wallet addresses in the clipboard to redirect funds.
- Amadey also downloads and installs additional malware families (e.g., Redline, Manuscript, BrowserHijackers) on the victim’s machine.
- C2 communications include HTTP POST requests carrying system/user information and wallet addresses, facilitating data exfiltration.
MITRE Techniques
- [T1566.001] Phishing – The article notes the Amadey bot is spreading through phishing sites; quote: ‘phishing sites’ used for spreading the Amadey bot.
“phishing sites, in addition to its usual method of being downloaded by the smoke loader through spam emails.” - [T1204] User Execution – Users are shown the phishing site and must click a download button; quote: ‘when they click the download button.’
- [T1055] Process Injection – The loader loads the Amadey bot into the running process; quote: ‘loads another DLL module’ and ‘executed using the ShellExecuteA() API.’
- [T1218] Signed Binary Proxy Execution – Execution path via Windows API (Rundll32) as described in the article’s broader MITRE mapping; quote: ‘Rundll32’ usage implied in the technique table.
- [T1106] Native API – The malware uses native Windows API calls (e.g., ShellExecuteA) to run dropped components; quote: ‘uses the ShellExecuteA() API.’
- [T1547] Registry Run Keys / Startup Folder – Persistence via a startup registry value; quote: ‘persistence by adding a “startup” value in the below registry key.’
- [T1053] Scheduled Task/Job – Persistence via Task Scheduler configured to run every minute; quote: ‘the Task Scheduler configured by the malware is set to execute the malicious sample every minute.’
- [T1027] Obfuscated/Compressed Files or Information – The DLL Module is protected by multiple layers and decrypted to load Amadey; quote: ‘The DLL Module is protected by multiple layers, which finally loads the Amadey bot.’
- [T1105] Ingress Tool Transfer – The downloader fetches additional payloads from a remote server (e.g., Seil.exe dropping Amadey); quote: ‘The downloaded .rar file contains a file named “Seil.exe” … which is responsible for downloading the Amadey bot from the remote server.’
- [T1059] Command and Scripting Interpreter – ShellExecuteA/command-like execution path used to run dropped modules; quote: ‘executes it using the ShellExecuteA() API.’
- [T1115] Clipboard Data – Clip64.dll intercepts clipboard content to swap crypto addresses; quote: ‘intercepts cryptocurrency transactions by replacing a victim’s intended recipient with the attacker’s wallet address.’
- [T1005] Data from Local System – The malware collects information from the victim’s machine before exfiltration; quote: ‘The POST request contains the following fields with the victim’s sensitive information, such as username, system name, etc.’
- [T1082] System Information Discovery – Data sent includes OS and user information; quote: ‘victim’s sensitive information’ including username and OS
- [T1071] Application Layer Protocol – C2 communication occurs via HTTP POST to the C2 server; quote: ‘POST request contains the following fields…’ and ‘connects to a Command and Control (C&C) server.’
Indicators of Compromise
- [SHA256] 0f74d2fb5d1b603cdac4bf0179feba25ee0343f759b71404e5cd120e32a60517 – Seil.exe
- [SHA256] b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65 – Amadey Bot
- [SHA256] 398235467c51419c4d2df6b9a0fad678730ae52b6db55d26e96f7ba70cae2dc3 – Cred64.dll
- [SHA256] 45f90d58562a9ee67bd129e4bbd538969aabd476e558aa0ff0a9cbdfb7d43a2e – Clip64.dll
- [URL] hxxps[:]//valorantcheatsboss[.]com/upload/boss/Bossmenu%20Setup[.]rar – Download URL
- [URL] hxxp[:]//valorantcheatsboss[.]com/upload/bass/808 – Download URL
- [URL] hxxp[:]//62[.]204[.]41[.]242/9vZbns/index[.]php – C2
- [Domain] valorantcheatsboss.com – Phishing/download host
- [File] C:Users[user-name]AppDataLocalTemp4b9a106e76nbveek.exe – Seil.exe drop location
Read more: https://blog.cyble.com/2023/01/25/the-rise-of-amadey-bot-a-growing-concern-for-internet-security/