Latest Amadey Uses Screen Capture, Pushes Remcos RAT

Zscaler ThreatLabZ describes a new Amadey bot variant distributed via the RIG Exploit Kit: the sample unpacks in two stages, checks for AV, installs persistently, loads plugins (cred.dll to harvest stored credentials from apps like FileZilla/WinSCP and scr.dll to capture screenshots), and exfiltrates data to C2 servers (e.g., sh1091505.a.had.su). The analysis also shows Amadey actively pushing additional payloads (Remcos RAT) from its control panel, documents IOCs (hashes, domains, IPs), and notes broad infection telemetry (notably Windows 7 prevalence and geographic distribution).