Amadey
Amadey is a modular malware-as-a-service loader/botnet active since 2018 and sold on Russian-language or darknet forums. It is primarily used as a dropper/loader to provide initial access to compromised Windows systems and deliver second-stage payloads, including infostealers and ransomware-related malware. Multiple sources in the content describe Amadey as frequently used alongside StealC, with Amadey enabling access and payload delivery while StealC steals credentials and other sensitive data.
The malware is mainly disseminated through phishing campaigns, though reporting in the content also notes delivery via fake software updates, cracked software installers, third-party malware loaders, GitHub in earlier activity, and an exploited self-hosted GitLab instance in a documented 2025 campaign. In that campaign, Amadey downloaded additional components including a clipper plugin and the StealC infostealer from gitlab.bzctoons.net.
Amadey is described as modular and capable of more than simple payload delivery. Reported capabilities include downloading and executing follow-on malware, information stealing, credential theft, clipboard monitoring or clipper functionality, screenshot capture, data exfiltration, and remote-access/RAT-like features including VNC-based access. One source states the main bot effectively works as a RAT, with dynamically tasked payload distribution from C2. ESET reporting in the content notes modules for clipboard monitoring, credential theft, and VNC-based remote access. Europol-linked reporting also states Amadey can retrieve sensitive data from infected systems.
Technical details directly mentioned in the content include HTTP-based C2 communications, RC4-encrypted communications or data exchange, hardcoded C2 URLs, embedded build identifiers, and anti-sandbox behavior requiring a live C2 response before registration and persistence complete. In the Trellix-described December 2025 campaign, Amadey used a mutex named f936986d553273aef6eeaeef713ad28f, stored an RC4/decryption key 828065b4fbbccc7d69743a0648c2f656 and bot ID 07072f in plaintext, beaconed to 91.92.243.129/0gjSy4hf3/index.php, requested plugin clip64.dll, downloaded StealC from https://gitlab.bzctoons.net/suau/fds/-/raw/main/protected.zip, and established persistence via the scheduled task file C:\Windows\Tasks\Yfgfwb.job. Reported hashes from that campaign were d7a366fa4d31c901ce3bcb6760d7bb5aa7cab49bb54d8c6551b3df14c8cf64e7 for the Amadey loader Yfgfwb.exe, bae0f38f58ad93728261f09840721ebedb9669a445f40083396fdd0da38a22a7 for clip64.dll, and b5d4cc84845cb101f8bda324729ebedd8acd36cc8ec32f80969c4fb6d3c2b8a7 for the StealC payload x64_protect.exe.
The content links Amadey to broad criminal use in larger attack chains and ransomware enablement. It is characterized as an early-stage access and delivery component in the cybercrime supply chain and as infrastructure disrupted during Operation Endgame in June 2026. Microsoft, Europol, and partners reported that Amadey and StealC shared infrastructure despite being developed by separate actors, and Microsoft also cited observed use of Amadey by the Russian-affiliated actor Secret Blizzard to deploy custom malware against targets in Ukraine. Targeting is broad and global rather than sector-specific in the provided content, with infections and victim systems discussed worldwide.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information.
A coordinated law enforcement operation, in partnership with private sector companies, including Bitdefender, Bitsight, ESET, and Microsoft, has resulted in the takedown of criminal infrastructure powering Amadey and StealC. ... SocGholish and Amadey function as loaders for introducing next-stage malware ... A C++-based modular backdoor, it's known to be active since October 2018 and advertised by a threat actor known as InCrease.
the group had deployed publicly available malware including gh0st RAT, QUASARRAT, and AMADEY
References https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Techniques & procedures
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
4 techniques
Initial Access
De buitgemaakte gegevens kunnen door criminelen gebruikt worden om zich voor te doen als het slachtoffer en er zodoende geld van te stelen, of om toegang te verkrijgen tot (bedrijfs)netwerken en daar meer slachtoffers te maken.
Via onder andere downloads van software uit onbetrouwbare bronnen of via phishing mails worden slachtoffers besmet.
Execution
4 techniques
Execution
The second major evolution arrived in the release of v5.03 in October 2024, which delivered a dense wave of new capabilities: hVNC with reverse connect, MSI silent installer support, RDP enabling, cmd.exe execution with SYSTEM privileges...
T1106 Native API Amadey utilizes various Windows API functions throughout its execution.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
7 techniques
Stealth
The malware stores all critical strings in the .rdata section in encrypted form... Amadey uses a modified Base64 algorithm for string decryption with a custom character set.
T1027.015 Obfuscated Files or Information: Compression Amadey can download, decompress, and execute payloads delivered in ZIP archives.
De buitgemaakte gegevens kunnen door criminelen gebruikt worden om zich voor te doen als het slachtoffer en er zodoende geld van te stelen, of om toegang te verkrijgen tot (bedrijfs)netwerken en daar meer slachtoffers te maken.
the abuse of trusted platforms such as GitHub or cloud-storage services to host payloads and evade filtering
T1140 Deobfuscate/Decode Files or Information Amadey and Stealc encrypt their strings, network traffic, and downloaded payloads.
Credential Access
2 techniques
Credential Access
Discovery
6 techniques
Discovery
T1012 Query Registry Amadey reads various data from the registry, such as data to harvest, Windows version, and keyboard layout.
Registration – the bot transmits RC4-encrypted system information encoded as a flat key-value string. This data includes the operating system version, username, PC name...
T1057 Process Discovery Amadey’s credential stealer plugin enumerates running processes to identify targeted applications. Stealc also enumerates running processes during its initial execution stage.
Amadey was seen last year "abusing GitHub as it collected system information from infected devices and installed customized payloads."
Collection
2 techniques
Collection
Command and Control
3 techniques
Command and Control
law enforcement leveraged the RICO Act ... to dismantle over 200 command hubs controlling malicious software networks.
IOCs tracked for this family
772 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
137 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used by attackers to deploy StealC in later stages. Microsoft and other researchers linked it to the same criminal infrastructure as StealC.
Malware used to provide initial access to victim systems and enable installation of additional payloads.
A MaaS loader used to deliver StealC and operating on shared infrastructure identified during the takedown.
A dropper/loader primarily spread through phishing campaigns that delivers additional malware to compromised systems and retrieves sensitive data.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.