Amadey Malware Analysis: How Digital Forensics and a Batch Script Helped Me Unlock the Mystery of the Infection Chain

No ratings

Presented at BSides London 2025 by

Ataur Rahman

Amadey malware looks simple at first glance, but its ability to disable Windows Defender and Sysinternals tools, persist indefinitely, and quietly steal credentials makes it far more dangerous than many assume. In this talk, I’ll share how I uncovered an infection chain that disabled Sysinternals tools, stole credentials from the infected device, and attempted to communicate with its C2 server. I will also share how I discovered the threat actor's active Discord server and GitHub repository link. Through a combination of disk forensics, memory analysis, and Windows Event Log investigation, I discovered that a seemingly ordinary batch script became the key to understanding the malware’s tactics. I’ll walk through the investigative journey, what I expected, what surprised me, and how each clue pieced together the bigger picture.