Saturday, May 18, 2024

Beware!! Hackers Distribute Amadey Malware Pushed via Software Cracks & Keygen Sites

Software cracks and keygen sites are used as bait to distribute the latest version of the Amadey Bot malware with the help of SmokeLoader malware.

The malware strain called Amadey was found over four years ago, and is capable of performing the following tasks:-

  • System reconnaissance
  • Stealing information
  • Loading additional payloads

Since 2020, there has been a steady decline in the prevalence of this malware. A new version of the virus has, however, been reported by the Korean researchers at AhnLab. 

SmokeLoader malware is also working in conjunction with this new version of the virus, which is also very old, but, still very active. Amadey’s shift away from Fallout and Rig exploit kits represents a significant departure from its previous strategy. 

Amadey’s new campaign

It is known that SmokeLoader makes use of software cracks or keygens to disguise itself, stimulating the victims to download and install the software voluntarily. 

When cracks and key generators are used, antivirus warnings are activated, making the user have to disable their antivirus program. The ease with which malware can be distributed, and makes them an ideal means for doing so.

It works by injecting its “Main Bot” into the process (explorer.exe) that is currently running on the system so that it becomes trusted by the OS and can download Amadey when it is executed.

The Amadey program automatically copies itself to the TEMP folder under the name “bguuwe.exe” once it has been downloaded and executed. With the help of the cmd.exe command, this creates a scheduled task that is responsible for maintaining persistence.

In the context of C2 communication, Amadey establishes contact with the threat actor’s server and sends a profile of the system to it. 

While the system profile includes the following information:-

  • OS version
  • Architecture type
  • Installed apps list 
  • List of installed AV tools

To respond, the server delivers instructions to download further plugins, as well as info-stealer malware like RedLine, which is designed to steal personal information from the victims.

With the aid of the ‘FXSUNATD.exe’ tool, Amadey is able to bypass UAC or perform DLL hijacking in an effort to install payloads with elevated privileges.

It has been found that the latest version of Amadey, version 3.21, is capable of discovering 14 different antivirus products. 

Targeted & abused Emails, FTPs, VPN clients

Malware can access email accounts, FTP servers, and VPN clients, as well as a variety of other types of information. Several different software applications can be targeted with the info-stealing plug-in, including:-

  • Mikrotik Router Management Program Winbox
  • Outlook
  • FileZilla
  • Pidgin
  • Total Commander FTP Client
  • RealVNC, TightVNC, TigerVNC
  • WinSCP

Keep the following things in mind in order to avoid the dangers of Amadey Bot and RedLine:-

  • Make sure you don’t download cracked files.
  • Activators for software products should not be downloaded.
  • Downloading illegitimate key generators should be avoided.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles