สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool Amadey

Threat Group Cards: A Threat Actor Encyclopedia

Tool: Amadey

Names	Amadey
Category	Malware
Type	Reconnaissance, Dropper
Description	(Cylance) Amadey is a simple Trojan bot first discovered in October of 2018. It is primarily used for collecting information on a victim's environment, though it can also deliver other malware. A major infection vector for Amadey are exploit kits such as RigEK and Fallout EK. During our monitoring, we also observed this Trojan being delivered via AZORult Infostealer on February 23rd to March 1st, and April 18th to June 5th. The sample hash values were not changed frequently. Recently, TA505 used Amadey for their campaign in April 2019.
Information	<https://threatvector.cylance.com/en_us/home/threat-spotlight-amadey-bot.html> <https://krabsonsecurity.com/2019/02/13/analyzing-amadey-a-simple-native-malware/>
MITRE ATT&CK	<https://attack.mitre.org/software/S1025/>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey>
AlienVault OTX	<https://otx.alienvault.com/browse/pulses?q=tag:amadey>

Last change to this tool card: 30 December 2022

Download this tool card in JSON format

All groups using tool Amadey

Changed	Name	Country	Observed
APT groups
	FIN11	[Unknown]	2016-Feb 2024
	TA505, Graceful Spider, Gold Evergreen		2006-Nov 2022

2 groups listed (2 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]