Amadey is a botnet, a type of malware that infects computers and turns them into “bots.” Amadey can also download additional malware and exfiltrate user information to a command and control (C2) server.
Features
Targets Windows-based systems. Amadey can spread through infected Microsoft Office documents, PDFs, or ZIP archives, as well as through compromised websites.
Silent operation. Amadey operators gain administrative privileges and remote access via a web browser to manage infected systems, without the victim user realizing that their system has become part of a botnet.
Persistence. Amadey achieves persistence by modifying the Windows registry, ensuring that the threat will run every time the system is rebooted.
Information gathering. Amadey collects system information (computer name, username, OS version, CPU architecture, etc.).
Ability to download other malware. Amadey often serves as a downloader for other malware.
Recognition of antivirus programs.
(by LLCPPC)
Downloader ("Tasks")
Screen capture (click on Uid in "All units")
Persistence in the system via autorun and scheduler
Elevation of privileges to the system level (running from svchost)
download:
Features
Targets Windows-based systems. Amadey can spread through infected Microsoft Office documents, PDFs, or ZIP archives, as well as through compromised websites.
Silent operation. Amadey operators gain administrative privileges and remote access via a web browser to manage infected systems, without the victim user realizing that their system has become part of a botnet.
Persistence. Amadey achieves persistence by modifying the Windows registry, ensuring that the threat will run every time the system is rebooted.
Information gathering. Amadey collects system information (computer name, username, OS version, CPU architecture, etc.).
Ability to download other malware. Amadey often serves as a downloader for other malware.
Recognition of antivirus programs.
(by LLCPPC)
Downloader ("Tasks")
Screen capture (click on Uid in "All units")
Persistence in the system via autorun and scheduler
Elevation of privileges to the system level (running from svchost)
download:
