Amadey Trojan Stealer is a MaaS-enabled malware that has persisted since 2018, delivering multiple payloads and plugins through a botnet. The post analyzes Amadey’s anti-sandbox behavior, persistence, defense evasion, C2 communications, and data collection capabilities, along with detections and IOCs.
Keypoints
- Amadey uses Malware as a Service (MaaS) to deliver itself and other payloads/plugins.
- Anti-sandbox techniques decode strings and terminate if the environment doesn’t match expected paths.
- Persistence is achieved via Registry Run Keys, startup folder modification, and scheduled tasks.
- Defense evasion includes modifying file and directory permissions with cacls.exe to hinder deletion.
- Execution leverages remote-signed PowerShell scripts to run downloaded payloads such as LockBit code.
- C2 and data exfiltration occur via HTTP POST with system information, using two concurrent threads.
- Data collection relies on DLL plugins clip64.dll (clipboard data) and cred64.dll (browser credentials) executed with rundll32.
MITRE Techniques
- [T1497.001] Virtualization/Sandbox Evasion – Amadey checks the running path and terminates if not matched, using two layers of encoding to evade detection. ‘If the running process is in %temp%{decrypted_folder_name}{decrypted_filename} e.g. (%tempa9e2a16078oneext.exe) … If the file location doesn’t match, Amadey will terminate its process.’
- [T1547.001] Registry Run Keys/Startup Folder – Amadey modifies registry keys (Run/RunOnce and User Shell Folders) to auto-start on reboot. ‘modifies the ‘startup’ value within the ‘User Shell Folders’ keys, enabling it to automatically execute its malicious drop file upon system reboot.’
- [T1053.005] Scheduled Task – Amadey creates scheduled tasks for persistence and potential privilege escalation. ‘Figure 5: Amadey Schedule tasks’
- [T1222.001] File and Directory Permissions Modification – Amadey uses cacls.exe to grant read-only access to the current user to hinder deletion of its drop copy. ‘cmd.exe /k echo Y| cacls “{folder_path_you_want_to_have_read_access_only}” /P “Administrator:R
- [T1059.001] PowerShell – Amadey remotely signs and executes PowerShell payloads (e.g., LockBit) using the RemoteSigned policy. ‘…leverages the RemoteSigned execution policy.’
- [T1071.001] Web Protocols – Amadey communicates with its C2 server using HTTP POST to exfiltrate system info. ‘The table below outlines the … HTTP POST data to its C2 server.’
- [T1115] Clipboard Data – clip64.dll collects clipboard data via GetClipboardData() and sends it to C2. ‘The clip64.dll plugin plays a pivotal role … GetClipboardData().’
- [T1555.003] Credentials from Web Browsers – cred64.dll targets browser credentials by accessing Chrome profile files (local state, login data) to decrypt stored passwords. ‘By interacting with these files, as shown in Figure 11.1, the plugin aims to retrieve and decrypt passwords.’
Indicators of Compromise
- [Hash] 617f4082c320c24f27f69d146aae6973a3cb818860ab196cf2800ff16518c2bc – Amadey
- [Hash] 89d30f7ba7b2af7f519d2fe066700fae723643e25b1859f32c60618956651710 – Amadey
- [Hash] 3d5d48ea2b6f76af583e541602950d89b8d96a13654469df3bc58dcddf879e9d – cred64.dll
- [Hash] 015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5 – clip64.dll
- [File name] clip64.dll – DLL plugin for clipboard data collection
- [File name] cred64.dll – DLL plugin for browser credential extraction
Read more: https://www.splunk.com/en_us/blog/security/amadey-threat-analysis-and-detections.html