{"id":10471,"date":"2025-07-18T12:35:37","date_gmt":"2025-07-18T05:35:37","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10471"},"modified":"2026-02-05T12:35:44","modified_gmt":"2026-02-05T05:35:44","slug":"github-bi-loi-dung-phat-tan-amadey-va-ma-doc-danh-cap-thong-tin-2","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/18\/github-bi-loi-dung-phat-tan-amadey-va-ma-doc-danh-cap-thong-tin-2\/","title":{"rendered":"GitHub b\u1ecb l\u1ee3i d\u1ee5ng ph\u00e1t t\u00e1n Amadey v\u00e0 m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp th\u00f4ng tin"},"content":{"rendered":"

M\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng \u0111ang \u00e2m th\u1ea7m di\u1ec5n ra nh\u1eafm v\u00e0o ng\u01b0\u1eddi d\u00f9ng Windows, s\u1eed d\u1ee5ng ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i Amadey nh\u01b0 m\u1ed9t \u0111i\u1ec3m trung chuy\u1ec3n \u0111\u1ec3 c\u00e0i th\u00eam nhi\u1ec1u m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u. K\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 t\u1eadn d\u1ee5ng c\u00e1c kho l\u01b0u tr\u1eef c\u00f4ng khai tr\u00ean GitHub nh\u01b0 m\u1ed9t tr\u1ea1m ph\u00e1t t\u00e1n payload, t\u1eeb \u0111\u00f3 v\u01b0\u1ee3t qua h\u1ea7u h\u1ebft c\u00e1c b\u1ed9 l\u1ecdc web truy\u1ec1n th\u1ed1ng. S\u1ef1 vi\u1ec7c m\u1ed9t l\u1ea7n n\u1eefa gi\u00f3ng l\u00ean h\u1ed3i chu\u00f4ng c\u1ea3nh b\u00e1o v\u1ec1 vi\u1ec7c c\u00e1c n\u1ec1n t\u1ea3ng h\u1ee3p ph\u00e1p c\u00f3 th\u1ec3 b\u1ecb bi\u1ebfn th\u00e0nh trung gian ph\u00e1t t\u00e1n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i.<\/b><\/p>\n

\n
\"amadey.png\"<\/div>\n<\/div>\n

Chi\u1ebfn d\u1ecbch b\u1eaft \u0111\u1ea7u b\u1eb1ng vi\u1ec7c c\u00e0i c\u1eafm m\u1ed9t tr\u00ecnh t\u1ea3i m\u00e3 \u0111\u1ed9c c\u00f3 t\u00ean Emmenhtal, c\u00f2n \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi t\u00ean PEAKLIGHT. M\u00e3 \u0111\u1ed9c n\u00e0y \u0111\u01b0\u1ee3c vi\u1ebft b\u1eb1ng ng\u00f4n ng\u1eef AutoIt, th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u00e1c c\u00f4ng c\u1ee5 t\u1ef1 \u0111\u1ed9ng h\u00f3a, cho ph\u00e9p ng\u1ee5y trang d\u1ec5 d\u00e0ng d\u01b0\u1edbi d\u1ea1ng ph\u1ea7n m\u1ec1m v\u00f4 h\u1ea1i. Emmenhtal \u0111\u01b0\u1ee3c \u0111\u00f3ng g\u00f3i c\u00f9ng th\u01b0 vi\u1ec7n DLL t\u00f9y bi\u1ebfn \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh vi \u1ea9n m\u00ecnh, bao g\u1ed3m gi\u00e1m s\u00e1t ti\u1ebfn tr\u00ecnh, che gi\u1ea5u ho\u1ea1t \u0111\u1ed9ng m\u1ea1ng v\u00e0 l\u00e0m ch\u1eadm qu\u00e1 tr\u00ecnh ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt. Sau khi \u0111\u01b0\u1ee3c th\u1ef1c thi, Emmenhtal thi\u1ebft l\u1eadp k\u1ebft n\u1ed1i t\u1edbi m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa, t\u1ea3i v\u1ec1 m\u00e3 \u0111\u1ed9c Amadey v\u00e0 k\u00edch ho\u1ea1t n\u00f3 th\u00f4ng qua ti\u1ec7n \u00edch mshta.exe c\u1ee7a Windows. \u0110\u00e2y l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt th\u01b0\u1eddng \u0111\u01b0\u1ee3c c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng nh\u1eb1m tr\u00e1nh b\u1ecb ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt ph\u00e1t hi\u1ec7n v\u00ec t\u1eadn d\u1ee5ng c\u00e1c th\u00e0nh ph\u1ea7n h\u1ee3p ph\u00e1p s\u1eb5n c\u00f3 trong h\u1ec7 \u0111i\u1ec1u h\u00e0nh thay v\u00ec g\u1ecdi tr\u1ef1c ti\u1ebfp c\u00e1c h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng.<\/p>\n

Amadey ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t n\u1ec1n t\u1ea3ng trung gian chuy\u00ean bi\u1ec7t, \u0111\u00f3ng vai tr\u00f2 nh\u01b0 m\u1ed9t h\u1ec7 \u0111i\u1ec1u h\u00e0nh thu nh\u1ecf d\u00e0nh ri\u00eang cho m\u00e3 \u0111\u1ed9c. Khi \u0111\u01b0\u1ee3c tri\u1ec3n khai v\u00e0o h\u1ec7 th\u1ed1ng, Amadey kh\u00f4ng t\u1ef1 th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh vi t\u1ea5n c\u00f4ng ph\u1ee9c t\u1ea1p m\u00e0 thay v\u00e0o \u0111\u00f3 h\u1ed7 tr\u1ee3 t\u1ea3i v\u00e0 qu\u1ea3n l\u00fd c\u00e1c plugin t\u00f9y bi\u1ebfn. C\u00e1c plugin n\u00e0y th\u1ef1c hi\u1ec7n t\u1eebng nhi\u1ec7m v\u1ee5 c\u1ee5 th\u1ec3 nh\u01b0 \u0111\u00e1nh c\u1eafp th\u00f4ng tin \u0111\u0103ng nh\u1eadp t\u1eeb tr\u00ecnh duy\u1ec7t, tr\u00edch xu\u1ea5t d\u1eef li\u1ec7u t\u1eeb ph\u1ea7n m\u1ec1m email, truy c\u1eadp v\u00e0o FTP v\u00e0 VPN ho\u1eb7c ch\u1ee5p l\u1ea1i m\u00e0n h\u00ecnh ng\u01b0\u1eddi d\u00f9ng theo th\u1eddi gian th\u1ef1c. Trong chi\u1ebfn d\u1ecbch l\u1ea7n n\u00e0y, Amadey \u0111\u01b0\u1ee3c l\u1eadp tr\u00ecnh \u0111\u1ec3 k\u1ebft n\u1ed1i t\u1edbi c\u00e1c kho l\u01b0u tr\u1eef c\u00f4ng khai tr\u00ean GitHub nh\u1eb1m t\u1ea3i v\u1ec1 c\u00e1c th\u00e0nh ph\u1ea7n \u0111\u1ed9c h\u1ea1i b\u1ed5 sung. Thay v\u00ec s\u1eed d\u1ee5ng h\u1ea1 t\u1ea7ng C2 truy\u1ec1n th\u1ed1ng d\u1ec5 b\u1ecb nh\u1eadn di\u1ec7n, nh\u00f3m t\u1ea5n c\u00f4ng t\u1eadn d\u1ee5ng GitHub nh\u01b0 m\u1ed9t m\u00e1y ch\u1ee7 ph\u00e2n ph\u1ed1i m\u00e3 \u0111\u1ed9c v\u1edbi l\u1ee3i th\u1ebf v\u01b0\u1ee3t qua h\u1ea7u h\u1ebft ch\u00ednh s\u00e1ch l\u1ecdc n\u1ed9i dung m\u1ea1ng nh\u1edd danh ti\u1ebfng v\u00e0 \u0111\u1ed9 tin c\u1eady v\u1ed1n c\u00f3 c\u1ee7a n\u1ec1n t\u1ea3ng n\u00e0y trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p.<\/p>\n

Chi\u1ebfn d\u1ecbch l\u1ee3i d\u1ee5ng ba t\u00e0i kho\u1ea3n GitHub c\u00f4ng khai g\u1ed3m Legendary99999, DFfe9ewf v\u00e0 Milidmdds \u0111\u1ec3 l\u01b0u tr\u1eef v\u00e0 ph\u00e2n ph\u1ed1i m\u00e3 \u0111\u1ed9c. C\u00e1c kho n\u00e0y ch\u1ee9a h\u00e0ng lo\u1ea1t t\u1ec7p th\u1ef1c thi \u0111\u1ecbnh d\u1ea1ng .exe, th\u01b0 vi\u1ec7n .dll v\u00e0 script PowerShell, \u0111\u00f3ng vai tr\u00f2 nh\u01b0 plugin m\u1edf r\u1ed9ng cho Amadey ho\u1eb7c \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng nh\u01b0 c\u00e1c payload \u0111\u1ed9c l\u1eadp. \u0110\u00e1ng ch\u00fa \u00fd, nhi\u1ec1u t\u1ec7p trong s\u1ed1 \u0111\u00f3 ch\u1ee9a c\u00e1c stealer \u0111\u00e3 c\u00f3 ti\u1ebfng tr\u00ean th\u1ecb tr\u01b0\u1eddng ch\u1ee3 \u0111en nh\u01b0 Lumma Stealer, RedLine Stealer v\u00e0 Rhadamanthys. \u0110\u00e2y \u0111\u1ec1u l\u00e0 nh\u1eefng m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf chuy\u00ean bi\u1ec7t \u0111\u1ec3 \u0111\u00e1nh c\u1eafp th\u00f4ng tin tr\u00ecnh duy\u1ec7t, cookie \u0111\u0103ng nh\u1eadp, d\u1eef li\u1ec7u v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed c\u00f9ng nhi\u1ec1u th\u00f4ng tin nh\u1ea1y c\u1ea3m kh\u00e1c c\u1ee7a ng\u01b0\u1eddi d\u00f9ng. Vi\u1ec7c t\u00edch h\u1ee3p c\u00e1c c\u00f4ng c\u1ee5 \u0111\u00e1nh c\u1eafp m\u1ea1nh nh\u01b0 v\u1eady gi\u00fap m\u1edf r\u1ed9ng \u0111\u00e1ng k\u1ec3 ph\u1ea1m vi khai th\u00e1c v\u00e0 gi\u00e1 tr\u1ecb c\u1ee7a m\u1ed7i m\u00e1y n\u1ea1n nh\u00e2n b\u1ecb ki\u1ec3m so\u00e1t.<\/p>\n

M\u1ed9t \u0111i\u1ec3m tinh vi trong chi\u1ebfn d\u1ecbch l\u00e0 vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c t\u1ec7p v\u0103n b\u1ea3n .txt tr\u00ean GitHub nh\u01b0 b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa \u1edf d\u1ea1ng th\u00f4 s\u01a1. M\u1ed7i t\u1ec7p ch\u1ee9a danh s\u00e1ch URL d\u1eabn \u0111\u1ebfn c\u00e1c payload th\u1ef1c s\u1ef1, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng d\u1ec5 d\u00e0ng c\u1eadp nh\u1eadt chu\u1ed7i t\u1ea3i xu\u1ed1ng m\u00e0 kh\u00f4ng c\u1ea7n ch\u1ec9nh s\u1eeda m\u00e3 Amadey \u0111\u00e3 c\u00e0i tr\u00ean m\u00e1y n\u1ea1n nh\u00e2n. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y gi\u00fap nh\u00f3m t\u1ea5n c\u00f4ng duy tr\u00ec s\u1ef1 linh ho\u1ea1t trong \u0111i\u1ec1u ph\u1ed1i chi\u1ebfn d\u1ecbch, \u0111\u1ed3ng th\u1eddi che gi\u1ea5u m\u1ee5c \u0111\u00edch th\u1ef1c s\u1ef1 b\u1eb1ng c\u00e1ch d\u00f9ng \u0111\u1ecbnh d\u1ea1ng v\u0103n b\u1ea3n \u0111\u01a1n gi\u1ea3n. Ch\u00ednh s\u1ef1 ng\u1ee5y trang n\u00e0y khi\u1ebfn vi\u1ec7c ph\u00e1t hi\u1ec7n h\u00e0nh vi \u0111\u1ed9c h\u1ea1i tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n, trong khi \u0111\u1ed9 tr\u1ec5 khi ph\u00e1t l\u1ec7nh v\u00e0 ph\u00e2n ph\u1ed1i m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c gi\u1eef \u1edf m\u1ee9c t\u1ed1i thi\u1ec3u.<\/p>\n

Chi\u1ebfn d\u1ecbch cho th\u1ea5y m\u1ee9c \u0111\u1ed9 nguy hi\u1ec3m khi m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ph\u00e2n ph\u1ed1i th\u00f4ng qua c\u00e1c n\u1ec1n t\u1ea3ng h\u1ee3p ph\u00e1p nh\u01b0 GitHub, n\u01a1i v\u1ed1n \u0111\u01b0\u1ee3c m\u1eb7c \u0111\u1ecbnh l\u00e0 an to\u00e0n. Vi\u1ec7c che gi\u1ea5u payload trong c\u00e1c kho l\u01b0u tr\u1eef c\u00f4ng khai gi\u00fap k\u1ebb t\u1ea5n c\u00f4ng d\u1ec5 d\u00e0ng v\u01b0\u1ee3t qua c\u00e1c l\u1edbp ph\u00f2ng v\u1ec7 truy\u1ec1n th\u1ed1ng. \u0110\u00e2y l\u00e0 l\u1eddi nh\u1eafc m\u1ea1nh m\u1ebd r\u1eb1ng ng\u01b0\u1eddi d\u00f9ng v\u00e0 c\u1ea3 c\u00e1c t\u1ed5 ch\u1ee9c c\u1ea7n th\u1eadn tr\u1ecdng h\u01a1n v\u1edbi m\u1ecdi t\u1ec7p t\u1ea3i v\u1ec1, d\u00f9 \u0111\u1ebfn t\u1eeb ngu\u1ed3n t\u01b0\u1edfng ch\u1eebng \u0111\u00e1ng tin c\u1eady.<\/p>\n

Theo The Hacker News<\/i><\/b>\u200b<\/div>\n
Theo: https:\/\/whitehat.vn\/threads\/github-bi-loi-dung-phat-tan-amadey-va-ma-doc-danh-cap-thong-tin.18579\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"

M\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng \u0111ang \u00e2m th\u1ea7m di\u1ec5n ra nh\u1eafm v\u00e0o ng\u01b0\u1eddi d\u00f9ng Windows, s\u1eed d\u1ee5ng ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i Amadey nh\u01b0 m\u1ed9t \u0111i\u1ec3m trung chuy\u1ec3n \u0111\u1ec3 c\u00e0i th\u00eam nhi\u1ec1u m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u. K\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 t\u1eadn d\u1ee5ng c\u00e1c kho l\u01b0u tr\u1eef c\u00f4ng khai tr\u00ean GitHub nh\u01b0 m\u1ed9t tr\u1ea1m ph\u00e1t […]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10471","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10471"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10471\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}