Procedure examples

Amadey can collect information from a compromised host.

Amadey can identify the IP address of a victim machine.

Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.

Amadey has collected the user name from a compromised host using `GetUserNameA`.

Amadey has sent victim data to its C2 servers.

Amadey has used HTTP for C2 communications.

Amadey has collected the computer name and OS version from a compromised machine.

Amadey has searched for folders associated with antivirus software.

Amadey can download and execute files to further infect a host machine with additional malware.

Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.

Amadey has overwritten registry keys for persistence.

Amadey has decoded antivirus name strings.

Amadey has checked for a variety of antivirus products.

Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.

Amadey has modified the `:Zone.Identifier` in the ADS area to zero.

Amadey has used fast flux DNS for its C2.

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.