Amadey Loader

Amadey Loader is a notorious malware that has been identified as a significant threat to computer systems. This malicious software, designed to exploit and damage your computer or device, can infect systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. The malware is distributed via the Amadey loader, which can be spread through phishing emails or downloads from compromised sites. Evidence has surfaced implicating an entity known as Eminem in carrying out cyber attacks using not only Remcos and GuLoader but also well-known malware such as Formbook and Amadey Loader. Despite claims by developers that Remcos and GuLoader are legitimate software, two truly malicious payloads were found within this folder, identified as Amadey Loader and the corresponding GuLoader shellcodes that load and decrypt these payloads. Proof of Eminem’s involvement in the distribution of malware, including the notorious Formbook info stealer and Amadey Loader, has been uncovered. In addition, Proofpoint observed at least five types of malware being delivered in this way, including the Lumma stealer, Amadey Loader, and JaskaGo. These findings present a comprehensive case for the involvement of Eminem in distributing these harmful programs. As a result, users should exercise caution when downloading files, opening emails, or visiting websites to avoid falling victim to such malicious software.