{"id":167990,"date":"2023-05-05T14:30:10","date_gmt":"2023-05-05T21:30:10","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=167990"},"modified":"2023-07-11T11:05:31","modified_gmt":"2023-07-11T18:05:31","slug":"deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/","title":{"rendered":"Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution"},"content":{"rendered":"

Authored by By Yashvi Shah<\/span><\/span>\u00a0<\/span><\/p>\n

McAfee Labs have identified an increase in Wextract.exe samples<\/span>,<\/span> that drop a malware payload at multiple stages. <\/span>\u00a0<\/span><\/p>\n

Wextract.exe is a Windows executable file that is used to extract files from a cabinet (.cab) file. Cabinet files are compressed archives that are used to package and distribute software, drivers, and other files. It is a legitimate file that is part of the Windows operating system, and it is located in the System32 folder of the Windows directory. However, like other executable files, it can be vulnerable to exploitation by malicious actors who might use it as a disguise for malware.<\/span>\u00a0<\/span><\/p>\n

Some common ways that malicious actors use a fake or modified version of wextract.exe include:<\/span>\u00a0<\/span><\/p>\n

    \n
  1. Malware Distribution<\/span><\/b>: Malicious actors can use a fake version of the wextract.exe to deliver malware onto a victim’s computer. They can disguise the malware as a legitimate file and use the fake wextract.exe to extract and execute the malicious code.<\/span>\u00a0<\/span><\/li>\n
  2. Information stealing<\/span><\/b>: A fake or modified wextract.exe can be used to steal sensitive information from a victim’s computer. Malicious actors can modify the code to include keyloggers or other data-stealing techniques.<\/span>\u00a0<\/span><\/li>\n
  3. Remote Access<\/span><\/b>: Malicious actors can use a fake wextract.exe to gain remote access to a victim’s computer. They can use the modified wextract.exe to create a backdoor or establish a remote connection to the victim’s computer, allowing them to carry out various malicious activities.<\/span>\u00a0<\/span><\/li>\n
  4. Ransomware Delivery<\/span><\/b>: Malicious actors can use a fake or modified “wextract.exe” to install ransomware on a victim’s system. For example, they may create a fake Windows Installer package that appears to be a legitimate software update or utility but also includes a modified “wextract.exe” that encrypts the victim’s files and demand<\/span>s <\/span>a ransom payment for their decryption. <\/span>\u00a0<\/span><\/li>\n<\/ol>\n

    McAfee Labs collected malicious wextract.exe samples from the wild, and its behavior was analyzed. <\/span>\u00a0<\/span><\/p>\n

    This blog provides a detailed technical analysis of malicious “wextract.exe” that is used as a delivery mechanism for multiple types of malware<\/span>s<\/span>, including Amadey and Redline Stealer. It also provides detailed information on the techniques used by the malware to evade detection by security software and execute its payload. Once the malware payloads are executed on the system, they establish communication with a Command and Control (C2) server controlled by the attacker. This communication allows the attacker to exfiltrate data from the victim’s system, including sensitive information such as login credentials, financial data, and other personal information.<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>1<\/span><\/span><\/span>: <\/span>Characteristic<\/span> of the file<\/span><\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    The file is a 32-bit Portable Executable file, which is 631.50 Kb in size. The original name of the file is WEXTRACT.EXE.MUI. The file description is “\u0421\u0430\u043c\u043e\u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 CAB-\u0444\u0430\u0439\u043b\u043e\u0432 Win32”, written in Russian, and means “Self-Extracting Win32 CAB Files”. The legal copyright mentions Microsoft Corporation. A lot of static strings of this file were found to be written in Russian.<\/span>\u00a0<\/span><\/p>\n

    Normally, the resource section (.rsrc) contains resources used by the program, such as icons, bitmaps, strings, and dialog boxes. Attackers leverage the resource section of a PE file to improve the success of their attacks by evading detection, enhancing persistence, and adding functionality.<\/span>\u00a0<\/span><\/p>\n

    The resource section of this sample has multiples files, out of which CABINET resource holds 75.75% of the total file, which makes the said resource suspicious.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>2<\/span><\/span><\/span>: Resources in the file<\/span><\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    A CAB (Cabinet) file is a compressed archive file format that is often used to compress and package multiple files into a single file for distribution or installation. A CAB file in the resource section of a PE file can be used for various purposes such as storing additional program files or data, including language-specific resources, or compressing and storing commonly used resources to reduce the size of the executable.\u00a0<\/span>\u00a0<\/span><\/p>\n

    The CABINET holds two executables, cydn.exe and vona.exe.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>3<\/span><\/span><\/span>: CABINET in resource section<\/span><\/span>\u00a0<\/span><\/p>\n

    \u00a0<\/span><\/p>\n

    Likewise, under RCDATA, there is another attribute called “RUNPROGRAM”, which starts cydn.exe.\u00a0<\/span>\u00a0<\/span>RUNPROGRAM in the resource section of a malware file typically refers to a resource that contains instructions for the malware to execute a specific program or command. When the malware is executed, it will load the resource containing the “RUNPROGRAM” command and attempt to execute the specified program or command. This technique is often used by malware authors to execute additional malicious programs or commands on the infected system. For example, the “RUNPROGRAM” resource may contains instructions to download and execute additional malware, or to launch a malicious script or command that can perform various malicious activities such as stealing sensitive data, creating backdoors, or disabling security software.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>4<\/span><\/span><\/span>: RUNPROGRAM attribute <\/span>stating<\/span> “cydn.exe”<\/span><\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    Like <\/span>RUNPROGRAM, POSTRUNPROGRAM<\/span> also holds the instruction to run the executable <\/span>after <\/span>RUNPROGRAM is executed. <\/span>Hence, once cydn.exe is executed, vona.exe will be executed.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>5<\/span><\/span><\/span>: POSTRUNPROGRAM stating “vona.exe”<\/span><\/span>\u00a0<\/span><\/p>\n

    Once WEXTRACT.exe is executed, both cydn.exe and vona.exe is dropped in the TEMP folder. The TEMP folder is a commonly used location for malware to store temporary files and other data, as it is typically writable by any user account and is not usually subject to strict security restrictions. This can make it easier for the malware to operate without raising suspicion or triggering security alerts.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>6<\/span><\/span><\/span>: Files dropped in TEMP folder<\/span><\/span>\u00a0<\/span><\/p>\n

    Stage 2: Analysis of cydn.exe<\/span><\/b>\u00a0<\/span><\/h2>\n

    The file showed high file ratio of the resource section, with the entropy of 7.810. Entropy is a measure of the randomness or unpredictability of the data in the file. It is often used as an indicator of whether a file is likely to be malicious or not.<\/span>\u00a0<\/span><\/p>\n

    In the case of a PE file, high entropy can indicate that the file contains a significant amount of compressed or encrypted data, or that it has been obfuscated or packed in a way that makes it more difficult to analyze. This can be a common technique used by malware authors to evade detection by antivirus software.<\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>7<\/span><\/span><\/span>: File ratio and entropy of the resource section<\/span><\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    Like <\/span>the <\/span>previous<\/span> file<\/span>, cydn.exe also had two executables archived in its resource section, named aydx.exe and mika.exe. The “RUNPROGRAM” attribute commands to run aydx.exe and the “POSTRUNPROGRAM” attribute commands to execute mika.exe once aydx.exe is executed. These file<\/span>s<\/span> are <\/span>also <\/span>dropped in TEMP folder.<\/span><\/span>\u00a0<\/span><\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>8<\/span><\/span><\/span>: aydx.exe and mika.exe packed in resource section<\/span><\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>9<\/span><\/span><\/span>: Executables dropped in another TEMP folder<\/span><\/span>\u00a0<\/span><\/p>\n

    The order of file execution is as follows: First, Wextract.exe and cydn.exe, which have already been discussed, are followed by aydx.exe, and then by mika.exe and vona.exe<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

     <\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>10<\/span><\/span><\/span>: Execution flow<\/span><\/span>\u00a0<\/span><\/p>\n

    Stage 3: Analysis of aydx.exe<\/span><\/b>\u00a0<\/span><\/h2>\n

    Aydx.exe is a 32-bit Portable Executable file, which is 405Kb and is compiled in C\/C++. Once executed, it attempts to make a request to IP address:\u202f<\/span>193.233.20.7<\/span><\/b>.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>11<\/span><\/span><\/span>: Malware trying to connect to IPv4<\/span><\/span>\u00a0<\/span><\/p>\n

    This IP address is linked with\u202f<\/span>Redline Stealer<\/span><\/i><\/b> connecting on port number 4138.<\/span>\u00a0<\/span><\/p>\n

    Analysis of mika.exe<\/span><\/b>\u00a0<\/span><\/p>\n

    Mika.exe is 32-bit Portable Executable, complied in .NET and is just 11 KB in size. The original name of the file is “Healer.exe”. This exe file makes no internet activity but does something in the target machine which assists malwares from further stages to carry out their execution.\u202f<\/span>\u00a0<\/span><\/p>\n

    The intent of mika.exe is to turn off Windows Defender in all possible ways. Once mika.exe was executed, this is how the Defender settings of the system looked like:<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>12<\/span><\/span><\/span>: Real-time protection turned off<\/span><\/span>\u00a0<\/span><\/p>\n

    This setting was irreversible and <\/span>couldn’t<\/span> be turned back to on via settings of Windows. Following this, logs from <\/span>Procmon<\/span> were analyzed and there were entries <\/span>regarding<\/span> Windows defender, such as:<\/span><\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Figure <\/span><\/span>13<\/span><\/span><\/span>: <\/span>Procmon<\/span> logs<\/span><\/span>\u00a0<\/span><\/p>\n

    To validate this, Registry was analysed and all the changes were found there. The changes in Registry were found to be in exact order as of Procmon logs. In Windows, the registry is a hierarchical database that stores configuration settings and options for the operating system, as well as for applications and devices. It is used to store information about the hardware, software, user preferences, and system settings on a Windows computer. Following keys are added under Real-Time Protection:<\/span>\u00a0<\/span><\/p>\n

      \n
    • DisableBehaviourMonitoring<\/span>\u00a0<\/span><\/li>\n
    • DisableIOAVProtection<\/span>\u00a0<\/span><\/li>\n
    • DisableOnAccessProtection<\/span>\u00a0<\/span><\/li>\n
    • DisableRealtimeMonitoring<\/span>\u00a0<\/span><\/li>\n
    • DisableScanOnRealitimeEnable<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>14<\/span><\/span><\/span>: Keys added in Registry<\/span><\/span>\u00a0<\/span><\/p>\n

      By doing so malware is restricting all the normal users from turning the Windows Defender on. When attackers disable Windows Defender through the registry, the change is likely to persist even if the user or administrator tries to re-enable it through the Windows Defender settings. This allows the attacker to maintain control over the system for a longer period. This supports malwares of further stages to easily execute themselves without any hinderances. This can be leveraged by all the malwares, regardless of their correspondence to this very campaign.<\/span>\u00a0<\/span><\/p>\n

      Stage 4: Analysis of vona.exe<\/span><\/b>\u00a0<\/span><\/h2>\n

      Vona.exe, a variant of the Amadey malware family, is compiled in C\/C++ and is 236 KB in size. This is the last file to be executed from the current cluster.\u202f When executed, a highly extensive process tree quickly appeared.<\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>15<\/span><\/span><\/span>: Process tree of vona.exe<\/span><\/span>\u00a0<\/span><\/p>\n

       <\/p>\n

      Stage 5: Analysis of mnolyk.exe<\/span><\/b>\u00a0<\/span><\/h2>\n

      An immediate child process of vona.exe is mnolyk.exe, another Amadey component, is dropped in a folder in TEMP folder.<\/span>\u00a0<\/span><\/p>\n

       <\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>16<\/span><\/span><\/span>: mnolyk.exe dropped in TEMP folder<\/span><\/span>\u00a0<\/span><\/p>\n

      Mnolyk.exe makes active connections to IP addresses\u202f<\/span>62.204.41.5<\/span><\/b>\u202fand\u202f<\/span>62.204.41.251<\/span><\/b>\u00a0<\/span><\/p>\n

      Malicious DLLs are downloaded from 62.204.41.5, which are executed later in the campaign. The target was made to search for two different DLLs, namely cred.dll and clip.dll.<\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>17<\/span><\/span><\/span>: Malicious <\/span>dlls<\/span> downloaded<\/span><\/span>\u00a0<\/span><\/p>\n

       <\/p>\n

      From 62.204.41.251, various exe files are downloaded <\/span>to<\/span> the TEMP folder, and later executed. Exes downloaded are:<\/span><\/span>\u00a0<\/span><\/p>\n

      fuka.exe<\/span><\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>18<\/span><\/span><\/span>: fuka.exe<\/span><\/span>\u00a0<\/span><\/p>\n

       <\/p>\n

      nikas.exe<\/span><\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>19<\/span><\/span><\/span>: nikas.exe<\/span><\/span>\u00a0<\/span><\/p>\n

      igla.exe<\/span><\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>20<\/span><\/span><\/span>: igla.exe<\/span><\/span>\u00a0<\/span><\/p>\n

      nocr.exe<\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>21<\/span><\/span><\/span>: nocr.exe<\/span><\/span>\u00a0<\/span><\/p>\n

      lebro.exe<\/p>\n

      \"\"<\/p>\n

      Figure <\/span><\/span>22<\/span><\/span><\/span>: lebro.exe<\/span><\/span>\u00a0<\/span><\/p>\n

       <\/p>\n

      Following the execution of mnolyk.exe, a series of schtasks.exe and cacls.exe were executed.<\/span>\u00a0<\/span><\/p>\n

      The command line for schtasks.exe is <\/span>“C:\\Windows\\System32\\schtasks.exe” \/Create \/SC MINUTE \/MO 1 \/TN mnolyk.exe \/TR “C:\\Users\\test\\AppData\\Local\\Temp\\5eb6b96734\\mnolyk.exe” \/F<\/span><\/i>\u00a0<\/span><\/p>\n

        \n
      • “\/Create” – This is the command to create a new scheduled task.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
          \n
        • “\/SC MINUTE” – This parameter sets the scheduling interval for the task to “MINUTE”. The task will run every minute.<\/span>\u00a0<\/span><\/li>\n
        • “\/MO 1” – This parameter sets the repeat count to “1”. The task will run only once.<\/span>\u00a0<\/span><\/li>\n
        • “\/TN” – This parameter specifies the name of the task. The name should be specified after the “\/TN” parameter.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

          So, the entire command line “schtasks.exe \/Create \/SC MINUTE \/MO 1 \/TN” would create a scheduled task that runs once every minute. The name of the task specified is the path to mnolyk.exe.<\/span>\u00a0<\/span><\/p>\n

          \u00a0<\/span><\/p>\n

          There were several instances of cacls.exe created. One of them is explained here along with its parameter. The command line is <\/span>“CACLS \u202f”mnolyk.exe” \/P “test:R” \/E”<\/span><\/i>\u00a0<\/span><\/p>\n

            \n
          • “CACLS” – This is the command to change the ACL of a file.<\/span>\u00a0<\/span><\/li>\n
          • “mnolyk.exe” – This is the file for which the ACL will be modified.<\/span>\u00a0<\/span><\/li>\n
          • “\/P test:R” – This parameter specifies the permission change for a user named “test”. The “:R” at the end indicates that the “test” user will be granted “Read” permission.<\/span>\u00a0<\/span><\/li>\n
          • “\/E” – This parameter specifies that the ACL change will be made to the file’s effective ACL. The effective ACL is the actual set of permissions that are applied to the file.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

            So, the entire command line “CACLS mnolyk.exe \/P test:R \/E” would grant the “test” user or group “Read” permission to the “mnolyk.exe” file. Hence the user “test” can neither write nor delete this file. If in place of “\/P test:R”, “\/P test:N” was mentioned, which is mentioned in one of the command line, it would give “None” permission to the user.<\/span>\u00a0<\/span><\/p>\n

            \u00a0<\/span><\/p>\n

            Stage 6: Analyzing fuka.exe, nikas.exe, igla.exe, nocr.exe and lebro.exe<\/span><\/b>\u00a0<\/span><\/h2>\n

            Fuka.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            Fukka.exe, a variant of the Redline Stealer malware family, is 175 KB and is compiled in .NET. The original name of the file is Samarium.exe. It shows some network activity with IP\u202f<\/span>193.233.20.11.<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>23<\/span><\/span><\/span>: Network activity of fuka.exe<\/span><\/span>\u00a0<\/span><\/p>\n

            Nikas.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            Nikas.exe is 248 KB executable file compiled in C\/C++. It disables automatic updates for Windows and checks the status of all the sub-fields of Real-Time Protection that were previously changed by mika.exe. No network activity was found during replication.<\/span>\u00a0<\/span><\/p>\n

            Igla.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            Igla.exe is 520 KB file, compiled in C\/C++. The original name of the file is WEXTRACT.EXE.MUI. Like we saw in cydn.exe, this PE has also two more exes packed in its resource section, bvPf.exe and cmkmka.exe. Once igla.exe is executed, bvPf.exe is executed, followed by cmkmka.exe.<\/span>\u00a0<\/span><\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>24<\/span><\/span><\/span>: RUNPROGRAM attribute in igla.exe<\/span><\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>25<\/span><\/span><\/span>: POSTRUNPROGRAM attribute <\/span>in<\/span> igla.exe<\/span><\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            bvPf.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            bvPf.exe is 306 KB in size and is compiled in C\/C++.\u202f The original filename is nightskywalker.exe. The file is dropped in a folder in TEMP folder of the system.<\/span>\u00a0<\/span><\/p>\n

            The exe has tried connecting to 193.233.20.11, but server did not respond, and no communication took place.<\/span>\u00a0<\/span><\/p>\n

            cmkmka.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            cmkmka.exe is 32-bit PE file, 283.5 KB in size. It further launches AppLaunch.exe which communicates to C2.<\/span>\u00a0<\/span><\/p>\n

            It communicates to the IP address:\u202f<\/span>176.113.115.17\u202f<\/span><\/i><\/b>which is an active C2 for\u202f<\/span>Redline Stealer<\/span><\/b> and connects to the port 4132.<\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>26<\/span><\/span><\/span>: Data exfiltration<\/span><\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            The blue-colored content in the data indicates the information being transmitted from the Command and Control (C2) server, which is providing instructions to the malware regarding the specific data that needs to be retrieved along with their corresponding paths. These paths include user profiles of different web browsers, various crypto wallet paths, and other related data.<\/span>\u00a0<\/span><\/p>\n

            As a response, all the data residing at the specified paths is sent back to the C2 server of the malware. This includes all the profiles of different web browsers, information related to crypto wallets, and even user-related data from the Windows operating system. This process allows the C2 server to collect a vast amount of sensitive information from the infected system, which could be exploited by the attackers for malicious purposes.<\/span>\u00a0<\/span><\/p>\n

            Nocr.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            Nocr.exe, a component of Redline Stealer, is a 175 KB .NET binary. The original name of the file is Alary.exe.\u00a0 It communicates to the IP address\u202f<\/span>176.113.115.17.<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

            Lebro.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            Lebro.exe, a component of Amadey, is a 235 KB file, compiled in C\/C++. Lebro.exe is responsible for executing nbveek.exe, which is a next stage of the malware. The file is again dropped in TEMP folder.<\/span>\u00a0<\/span><\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>27<\/span><\/span><\/span>: Dropping another executable in TEMP folder<\/span><\/span>\u00a0<\/span><\/p>\n

            Stage 7: Analyzing nbveek.exe<\/span><\/b>\u00a0<\/span><\/h2>\n

            The hashes of lebro.exe and nbveek.exe are same, they are the same binaries, hence it is\u202f<\/span>Amadey<\/span><\/b>. It is connecting to IP\u202f<\/span>62.204.41.88.\u202f<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

             <\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>28<\/span><\/span><\/span>: Network activity of nbveek.exe<\/span><\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            The target system executes a php file, and the content of file includes the command to download another exe called setupff.exe. This exe is downloaded to the TEMP folder.<\/span>\u00a0<\/span><\/p>\n

            Before setupff.exe is executed, again the series of schtasks.exe and cacls.exe are executed which were seen previously also. The same parameters were passed for nbveek.exe as they were for mnolyk.exe.<\/span>\u00a0<\/span><\/p>\n

            Setupff.exe<\/span><\/b>\u00a0<\/span><\/p>\n

            Setupff.exe is compiled in C\/C++ and is 795 KB.\u202f The file could not execute and threw Windows error.<\/span>\u00a0<\/span><\/p>\n

            Stage 8: Final stage<\/span><\/b>\u00a0<\/span><\/h2>\n

            Later, another instance of setupff.exe was created which further invokes multiple instances of rundll32.exe. Here, the two dlls downloaded by mnolyk.exe, clip64.dll and cred64.dll, are executed through rundll32.exe. McAfee Labs detects these dlls to be Amadey maware.<\/span>\u00a0<\/span><\/p>\n

            The network activity shows the dll to be connecting to <\/span>62.204.41.88<\/span><\/i><\/b>. This dll again starts exfiltrating data to C2:<\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            \"\"<\/p>\n

            Figure <\/span><\/span>29<\/span><\/span><\/span>:<\/span>Data exfiltration<\/span><\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            To conclude, the threat posed by the multi-stage attack that drops the Amadey botnet, and subsequently Redline Stealer, is significant and requires constant vigilance from both consumers and security professionals. By using the Amadey botnet as a delivery mechanism for other malware, attackers can leverage these same capabilities to evade detection and maintain persistence on infected computers. They can use Amadey to drop a wide range of malware, such as spyware, ransomware, and trojans, which can be used for a variety of malicious purposes, such as stealing sensitive information, encrypting files for ransom, or taking control of a computer for use in a larger botnet. Our analysis of various samples of this attack has revealed that the Amadey botnet distributes malware from multiple families and is not restricted to Redline Stealer alone.<\/span>\u00a0<\/span><\/p>\n

            At McAfee, we are committed to providing our customers with robust and effective antivirus and anti-malware solutions that can detect and protect against threats like the Amadey botnet and other malware families. Our security software uses a combination of signature, machine learning, threat intelligence and behavioral-based detection techniques to identify and stop threats before they can cause damage.<\/span>\u00a0<\/span><\/p>\n

             <\/p>\n

            Indicators of Compromise (IOCs):<\/span><\/b>\u00a0<\/span><\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
            File Type<\/span><\/i><\/b>\u00a0<\/span><\/td>\nSHA-256<\/span><\/i><\/b>\u00a0<\/span><\/td>\nProduct<\/span><\/i><\/b>\u00a0<\/span><\/td>\nDetection<\/span><\/i><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n80fed7cd4c7d7cb0c05fe128ced6ab2b9b3d7f03edcf5ef532c8236f00ee7376<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nDownloader-FCND<\/span>
            \nLockbit-FSWW<\/span>
            \nPWS-FDON<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\nd8e9b2d3afd0eab91f94e1a1a1a0a97aa2974225f4f086a66e76dbf4b705a800<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPWS-FDON<\/span>
            \nLockbit-FSWW<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n1d51e0964268b35afb43320513ad9837ec6b1c0bd0e56065ead5d99b385967b5<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nLockbit-FSWW<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPWS-FDON<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nDownloader-FCND<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nDownloader-FCND<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n8020580744f6861a611e99ba17e92751499e4b0f013d66a103fb38c5f256bbb2<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nAgentTesla-FCYU<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n021ae2fadbc8bc4e83013de03902e6e97c2815ab821adaa58037e562a6b2357b<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nLockbit-FSWW<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\naab1460440bee10e2efec9b5c83ea20ed85e7a17d4ed3b4a19341148255d54b1<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nLockbit-FSWW<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n54ce28a037eea87448e65bc25f8d3a38ddd4b4679516cc59899b77150aa46fcc<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nGenericRXVK-HF<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\n0cca99711baf600eb030bbfcf279faf74c564084e733df3d9e98bea3e4e2f45f<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nAgentTesla-FCYU<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\nad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nDownloader-FCND<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\nad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nDownloader-FCND<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .exe<\/span>\u00a0<\/span><\/td>\nd40d2bfa9fcbf980f76ce224ab6037ebd2b081cb518fa65b8e208f84bc155e41<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nGenericRXVJ-QP<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .dll<\/span>\u00a0<\/span><\/td>\ncdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPWS-FDOE<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .dll<\/span>\u00a0<\/span><\/td>\n10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nTrojan-FUUW<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            .dll<\/span>\u00a0<\/span><\/td>\n3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nTrojan-FUUW<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            IPv4<\/span>\u00a0<\/span><\/td>\n193.233.20.7<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            IPv4<\/span>\u00a0<\/span><\/td>\n62.204.41.5<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            IPv4<\/span>\u00a0<\/span><\/td>\n62.204.41.251<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            IPv4<\/span>\u00a0<\/span><\/td>\n193.233.20.11<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            IPv4<\/span>\u00a0<\/span><\/td>\n176.113.115.17<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
            IPv4<\/span>\u00a0<\/span><\/td>\n62.204.41.88<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n\u202f<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            \u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

            Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at…<\/p>\n","protected":false},"author":695,"featured_media":169232,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[4136],"class_list":["post-167990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"\nDeconstructing Amadey's Latest Multi-Stage Attack and Malware Distribution | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages. \u00a0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Deconstructing Amadey's Latest Multi-Stage Attack and Malware Distribution | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages. \u00a0\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-05T21:30:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-11T18:05:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution\",\"datePublished\":\"2023-05-05T21:30:10+00:00\",\"dateModified\":\"2023-07-11T18:05:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/\"},\"wordCount\":3224,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/\",\"name\":\"Deconstructing Amadey's Latest Multi-Stage Attack and Malware Distribution | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png\",\"datePublished\":\"2023-05-05T21:30:10+00:00\",\"dateModified\":\"2023-07-11T18:05:31+00:00\",\"description\":\"Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages. \u00a0\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Deconstructing Amadey's Latest Multi-Stage Attack and Malware Distribution | McAfee Blog","description":"Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages. \u00a0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Deconstructing Amadey's Latest Multi-Stage Attack and Malware Distribution | McAfee Blog","og_description":"Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages. \u00a0","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2023-05-05T21:30:10+00:00","article_modified_time":"2023-07-11T18:05:31+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png","type":"image\/png"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"16 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution","datePublished":"2023-05-05T21:30:10+00:00","dateModified":"2023-07-11T18:05:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/"},"wordCount":3224,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/","name":"Deconstructing Amadey's Latest Multi-Stage Attack and Malware Distribution | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png","datePublished":"2023-05-05T21:30:10+00:00","dateModified":"2023-07-11T18:05:31+00:00","description":"Authored by By Yashvi Shah\u00a0 McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages. \u00a0","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/05\/300x200_Blog_Amadey-Malware.png","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/167990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=167990"}],"version-history":[{"count":6,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/167990\/revisions"}],"predecessor-version":[{"id":171476,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/167990\/revisions\/171476"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/169232"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=167990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=167990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=167990"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=167990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}