Amadey is a simple Trojan bot first discovered in October of 2018. It is primarily used for collecting information on a victim’s environment, though it can also deliver other malware.
A major infection vector for Amadey are exploit kits such as RigEK and Fallout EK. During our monitoring, we also observed this Trojan being delivered via AZORult Infostealer on February 23 to March 1, and April 18 to June 5. The sample hash values were not changed frequently. Recently, TA505 used Amadey for their campaign in April 2019.
This technical blog reveals the detailed behavior of Amadey and examines its AZORult campaign. It focuses on the latest sample (DE8A40568834EAF2F84A352D91D4EA1BB3081407867B12F33358ABD262DC7182) which was actively spread for about a month.
Source: BlackBerry Cylance