Loading malware…
Andromeda, also known as Gamarue and Wauchos, is a modular Windows botnet malware family first observed in 2011 and active for years as a widely used crimeware platform. It operates primarily as an HTTP-based bot that profiles infected systems, communicates with command-and-control infrastructure, installs plug-ins, downloads and executes additional payloads, updates itself, and can remove components on operator command. It was frequently used as a distribution layer for other malware families, including banking trojans and other criminal payloads, and also appeared in malware-as-a-service ecosystems.
Andromeda commonly spread through exploit kits on compromised websites and was also delivered in spam-driven campaigns as part of broader affiliate distribution chains. Once executed, it typically used layered packing and obfuscated API resolution, then injected its payload into remote processes using process hollowing. Multiple versions incorporated anti-analysis and defense-evasion features such as anti-VM checks, anti-debugging, custom exception handling, API hashing, opaque predicates, inline API hooking, and logic to divert execution or stall when analysis tools or virtualization artifacts were detected.
The malware established persistence through autorun mechanisms and, in some variants, maintained watchdog functionality to restore deleted files or modified configuration. Its payload collected victim system information and exchanged encrypted tasking with its controllers over HTTP POST. Supported tasking included downloading and executing executables, installing or deleting DLLs and plug-ins, self-updating, and uninstalling itself. Later variants evolved their command formats and encryption while retaining RC4-protected communications and integrity checks.
Andromeda was heavily used in criminal operations as a delivery bot for follow-on malware such as Dridex, UrlZone, Chthonic, and other payloads. It was also associated with major cybercrime infrastructure and distribution ecosystems, including exploit-kit activity and large botnet operations, until international disruption efforts in 2017 significantly impacted the botnet and appear to have ended its development.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Andromeda botnet is a well-known botnet that surfaced around 2011 ... The main purpose of spreading Andromeda is to cast a wide net and gain control of endpoints ... On certain instances, GamaPoS is installed.
The Andromeda botnet is a well-known botnet that surfaced around 2011 ... The main purpose of spreading Andromeda is to cast a wide net and gain control of endpoints ... On certain instances, GamaPoS is installed.
"...spear-phishing emails with malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158..." | "...use of the Andromeda Trojan as an initial payload in their attacks to download and execute other tools in their toolset."
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Début 2013, avant que le code malveillant Carbanak (alias Anunak, Sekur) ne soit développé, le groupe cybercriminel aurait souscrit à des Malware-as-a-Service, tels qu’Andromeda (alias Gamarue) et Pony.
...later campaigns occasionally used Pony or Andromeda as intermediate loaders to distribute various instances of Dridex.
"...use of the Andromeda Trojan as an initial payload in their attacks to download and execute other tools in their toolset."
"...a legacy ANDROMEDA sample was automatically installed and began to beacon out."
C0026 ... selective distribution of KOPILUWAK and QUIETCANARY malware to previous ANDROMEDA malware victims in Ukraine through re-registered ANDROMEDA C2 domains.
...CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Spora adds the hidden attribute to files and folders on the desktop, in the root of removable drives and the system drive... Spora then puts Windows shortcuts with the same name and icon as the hidden files and folders as a visible replacement.
I met one of those bot (v2.5 ... ) as a second stage of an Andromeda pushed in Nuclear Pack
Eventually, waiting for a command in an infinite loop, it sniffs port 8000. A received command will then be run in the command window.
Eventually, waiting for a command in an infinite loop, it sniffs port 8000. A received command will then be run in the command window.
This malware uses very uncommon API functions in low-level form (Nt/Rtl), which is probably used to avoid standard API monitors/tracers, sandboxes and other dynamic analysis tools
...les aurait distribués par point d’eau via le kit d’exploitation Neutrino.
Additionally, the two processes communicate with each other through an instance of creating a pipe connection.
This part of code is executed when the environment variable ‘svch’ has not been found. The bot tries to connect to the pipe name, which is ‘kill’ xor’ed by the VolumeSerialNumber.
As part of its evolution, version 2.07 implements a custom exception handler using a call to SetUnhandledExceptionFilter. Similarly, version 2.08 calls RtlAddVectoredExceptionHandler and adds the custom handler as the first handler into the vectored exception handler chain (VEH).
First, it modifies the registry entry HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list to the value of %s:*:Generic Host Process, which points to the path of the current process.
A suspended process of the file to be injected is created... Before it calls ResumeThread to resume the process, it changes the entry point of the injected file to point to its code.
Following that, it creates an autorun registry for the dropped file as follows: Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ValueName: SunJavaUpdateSched
Gamarue, Dinihou and now also Spora use Windows shortcuts (.LNK files) instead. Spora adds the hidden attribute to files and folders on the desktop, in the root of removable drives and the system drive. Spora then puts Windows shortcuts with the same name and icon as the hidden files and folders as a visible replacement.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
It then calls QueueUserAPC, which creates an asynchronous procedure call object. This object points to the code which decrypts some encrypted strings using RC4 decryption.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
A suspended process of the file to be injected is created... Before it calls ResumeThread to resume the process, it changes the entry point of the injected file to point to its code.
Following that, it creates an autorun registry for the dropped file as follows: Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ValueName: SunJavaUpdateSched
Gamarue, Dinihou and now also Spora use Windows shortcuts (.LNK files) instead. Spora adds the hidden attribute to files and folders on the desktop, in the root of removable drives and the system drive. Spora then puts Windows shortcuts with the same name and icon as the hidden files and folders as a visible replacement.
Version 2.10 also keeps an array of API hash values. The hash algorithm is a custom function and, in order to complicate static analysis further, the author incorporates opaque predicates.
When the message is prepared for the required information, in all versions except the most recent one, the string is encrypted in two steps. The first step uses a 20-byte hard-coded RC4 key and the second step uses base64 encoding. Version 2.10 encrypts the message only using the RC4 algorithm.
If the bot does detect the presence of either a debugger or a virtual machine, it decrypts the dummy code. This code copies itself under %alluserprofiles% as svchost.exe with hidden system file attributes.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
It then calls QueueUserAPC, which creates an asynchronous procedure call object. This object points to the code which decrypts some encrypted strings using RC4 decryption.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
It uses this path to create a copy of the original file before deleting it, and saves it in %alluserprofile% with a random filename... The original file in the old path is deleted.
In these variants, the loader enumerates the processes running on the machine and compares them against a list of unwanted processes.
Iterating through process names and computing their CRC32 hash values... Trying to load the libraries guard32.dll and sbiedll.dll... Querying for a value... to search for the presence of any virtual machine.
This code copies itself under %alluserprofiles% as svchost.exe with hidden system file attributes.
As part of its evolution, version 2.07 implements a custom exception handler using a call to SetUnhandledExceptionFilter. Similarly, version 2.08 calls RtlAddVectoredExceptionHandler and adds the custom handler as the first handler into the vectored exception handler chain (VEH).
Formbook ... can retrieve authorization and login credentials from a web data form before the information reaches a secure server, bypassing HTTPS encryption. ... Formgrabbers intercept HTTP(S) data and use inline hooking ... to capture a user's information before the user submits it
Querying for a value in the system\currentcontrolset\services\disk\enum registry to search for the presence of any virtual machine.
The main aim of Andromeda's payload is to steal the infected system's information, talk to the command-and-control (C&C) server, and download and install additional malware onto the system.
In these variants, the loader enumerates the processes running on the machine and compares them against a list of unwanted processes.
Formbook ... can retrieve authorization and login credentials from a web data form before the information reaches a secure server, bypassing HTTPS encryption. ... Formgrabbers intercept HTTP(S) data and use inline hooking ... to capture a user's information before the user submits it
As shown in Table 2, each version has two message formats, both sent as HTTP POST requests: Action Request and Task Report.
As shown in Table 2, each version has two message formats, both sent as HTTP POST requests: Action Request and Task Report.
The hooked GetAddrInfoW API performs a DNS query for the input host name from Google DNS server 8.8.4.4... The DNS record received is then used for querying the C&C domain name.
248 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A commodity trojan, originally developed in 2011, observed re-emerging to target Ukraine public sector networks.
Referenced as an established malware family into which Socks5Systemz was integrated as a SOCKS5 proxy module.
A malware family used as part of a botnet, most commonly observed as a USB-spreading worm. It has been used to spread other malware, steal information, and perform activities such as click fraud.
Botnet malware family, some variants act as worms spreading via USB drives.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.