Monday, March 4, 2024

Beware!! Hackers Distribute Amadey Malware Pushed via Software Cracks & Keygen Sites

Software cracks and keygen sites are used as bait to distribute the latest version of the Amadey Bot malware with the help of SmokeLoader malware.

The malware strain called Amadey was found over four years ago, and is capable of performing the following tasks:-

  • System reconnaissance
  • Stealing information
  • Loading additional payloads

Since 2020, there has been a steady decline in the prevalence of this malware. A new version of the virus has, however, been reported by the Korean researchers at AhnLab. 

SmokeLoader malware is also working in conjunction with this new version of the virus, which is also very old, but, still very active. Amadey’s shift away from Fallout and Rig exploit kits represents a significant departure from its previous strategy. 

Amadey’s new campaign

It is known that SmokeLoader makes use of software cracks or keygens to disguise itself, stimulating the victims to download and install the software voluntarily. 

When cracks and key generators are used, antivirus warnings are activated, making the user have to disable their antivirus program. The ease with which malware can be distributed, and makes them an ideal means for doing so.

It works by injecting its “Main Bot” into the process (explorer.exe) that is currently running on the system so that it becomes trusted by the OS and can download Amadey when it is executed.

The Amadey program automatically copies itself to the TEMP folder under the name “bguuwe.exe” once it has been downloaded and executed. With the help of the cmd.exe command, this creates a scheduled task that is responsible for maintaining persistence.

In the context of C2 communication, Amadey establishes contact with the threat actor’s server and sends a profile of the system to it. 

While the system profile includes the following information:-

  • OS version
  • Architecture type
  • Installed apps list 
  • List of installed AV tools

To respond, the server delivers instructions to download further plugins, as well as info-stealer malware like RedLine, which is designed to steal personal information from the victims.

With the aid of the ‘FXSUNATD.exe’ tool, Amadey is able to bypass UAC or perform DLL hijacking in an effort to install payloads with elevated privileges.

It has been found that the latest version of Amadey, version 3.21, is capable of discovering 14 different antivirus products. 

Targeted & abused Emails, FTPs, VPN clients

Malware can access email accounts, FTP servers, and VPN clients, as well as a variety of other types of information. Several different software applications can be targeted with the info-stealing plug-in, including:-

  • Mikrotik Router Management Program Winbox
  • Outlook
  • FileZilla
  • Pidgin
  • Total Commander FTP Client
  • RealVNC, TightVNC, TigerVNC
  • WinSCP

Keep the following things in mind in order to avoid the dangers of Amadey Bot and RedLine:-

  • Make sure you don’t download cracked files.
  • Activators for software products should not be downloaded.
  • Downloading illegitimate key generators should be avoided.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.


Latest articles

US Court Orders NSO Group to Handover Code for Spyware, Pegasus to WhatsApp

Meta, the company that owns WhatsApp, filed a lawsuit against NSO Group in 2019....

New SSO-Based Phishing Attack Trick Users into Sharing Login Credentials  

Threat actors employ phishing scams to trick individuals into giving away important details like...

U.S. Charged Iranian Hacker, Rewards up to $10 Million

The United States Department of Justice (DoJ) has charged an Iranian national, Alireza Shafie...

Huge Surge in Ransomware-as-a-Service Attacks targeting Middle East & Africa

The Middle East and Africa (MEA) region has witnessed a surge in ransomware-as-a-service (RaaS)...

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles