Loading malware…
Andromeda, also widely known as Gamarue and Wauchos, is a modular Windows bot malware family first observed in 2011 and active for years as a criminal malware-as-a-service and botnet platform. It is best known as an HTTP-based bot used to profile infected systems, maintain command-and-control communications, download and execute additional payloads, install plug-ins, update itself, and remove components on operator command. The family was heavily used as a distribution layer for other malware and appeared in multiple criminal ecosystems, including exploit-kit-driven infections and spam-delivered campaigns. It was also associated with broader botnet operations and later disruption efforts around 2017.
Andromeda commonly infected victims through exploit kits hosted on compromised websites, and it was also observed as an attachment or intermediate payload in email-borne malware campaigns. Some variants spread through infected USB media and worm-like abuse of Windows shortcut files, contributing to its broad reach. Once executed, Andromeda typically unpacked a small loader that used obfuscated API resolution, anti-debugging, anti-virtualization, and anti-analysis checks before injecting its payload into remote processes. Process hollowing and related in-memory execution were core traits, and later variants added stronger self-defense, watchdog behavior, persistence restoration, inline API hooking, and stealthier inter-process coordination.
Its command-and-control protocol used HTTP POST traffic with encrypted tasking and reporting. Across versions, Andromeda used RC4-based protection for outbound and inbound data, with later variants changing message formats and encryption details, including JSON-based structures in newer builds. Supported tasking included downloading and running executables, loading plug-ins, installing or deleting DLL-based components, self-updating, and uninstalling itself. The malware also gathered host metadata for bot identification and operational management.
Andromeda was frequently used as a first-stage delivery mechanism for other malware families, including banking trojans, credential stealers, spam bots, remote access tools, and DDoS bots. It has been linked in reporting to delivery chains involving UrlZone, Chthonic, Pony, Pushdo, Neutrino Bot, Proteus, and CoalaBot, among others. Criminal groups and affiliates, including actors tied to large spam and exploit-kit operations, used it as rentable infrastructure. Its prevalence, modularity, and role as a malware distribution platform made it one of the more significant commodity botnets of its era.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Andromeda botnet is a well-known botnet that surfaced around 2011 ... The main purpose of spreading Andromeda is to cast a wide net and gain control of endpoints ... On certain instances, GamaPoS is installed.
The Andromeda botnet is a well-known botnet that surfaced around 2011 ... The main purpose of spreading Andromeda is to cast a wide net and gain control of endpoints ... On certain instances, GamaPoS is installed.
"...spear-phishing emails with malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158..." | "...use of the Andromeda Trojan as an initial payload in their attacks to download and execute other tools in their toolset."
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Début 2013, avant que le code malveillant Carbanak (alias Anunak, Sekur) ne soit développé, le groupe cybercriminel aurait souscrit à des Malware-as-a-Service, tels qu’Andromeda (alias Gamarue) et Pony.
...later campaigns occasionally used Pony or Andromeda as intermediate loaders to distribute various instances of Dridex.
"...use of the Andromeda Trojan as an initial payload in their attacks to download and execute other tools in their toolset."
"...a legacy ANDROMEDA sample was automatically installed and began to beacon out."
C0026 ... selective distribution of KOPILUWAK and QUIETCANARY malware to previous ANDROMEDA malware victims in Ukraine through re-registered ANDROMEDA C2 domains.
...CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Gamarue ... some variants are worms and frequently spread via infected USB drives
I met one of those bot (v2.5 ... ) as a second stage of an Andromeda pushed in Nuclear Pack
Eventually, waiting for a command in an infinite loop, it sniffs port 8000. A received command will then be run in the command window.
Eventually, waiting for a command in an infinite loop, it sniffs port 8000. A received command will then be run in the command window.
...les aurait distribués par point d’eau via le kit d’exploitation Neutrino.
Additionally, the two processes communicate with each other through an instance of creating a pipe connection.
This part of code is executed when the environment variable ‘svch’ has not been found. The bot tries to connect to the pipe name, which is ‘kill’ xor’ed by the VolumeSerialNumber.
As part of its evolution, version 2.07 implements a custom exception handler using a call to SetUnhandledExceptionFilter. Similarly, version 2.08 calls RtlAddVectoredExceptionHandler and adds the custom handler as the first handler into the vectored exception handler chain (VEH).
First, it modifies the registry entry HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list to the value of %s:*:Generic Host Process, which points to the path of the current process.
A suspended process of the file to be injected is created... Before it calls ResumeThread to resume the process, it changes the entry point of the injected file to point to its code.
Following that, it creates an autorun registry for the dropped file as follows: Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ValueName: SunJavaUpdateSched
Gamarue, Dinihou and now also Spora use Windows shortcuts (.LNK files) instead. Spora adds the hidden attribute to files and folders on the desktop, in the root of removable drives and the system drive. Spora then puts Windows shortcuts with the same name and icon as the hidden files and folders as a visible replacement.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
It then calls QueueUserAPC, which creates an asynchronous procedure call object. This object points to the code which decrypts some encrypted strings using RC4 decryption.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
A suspended process of the file to be injected is created... Before it calls ResumeThread to resume the process, it changes the entry point of the injected file to point to its code.
Following that, it creates an autorun registry for the dropped file as follows: Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ValueName: SunJavaUpdateSched
Gamarue, Dinihou and now also Spora use Windows shortcuts (.LNK files) instead. Spora adds the hidden attribute to files and folders on the desktop, in the root of removable drives and the system drive. Spora then puts Windows shortcuts with the same name and icon as the hidden files and folders as a visible replacement.
Version 2.10 also keeps an array of API hash values. The hash algorithm is a custom function and, in order to complicate static analysis further, the author incorporates opaque predicates.
When the message is prepared for the required information, in all versions except the most recent one, the string is encrypted in two steps. The first step uses a 20-byte hard-coded RC4 key and the second step uses base64 encoding. Version 2.10 encrypts the message only using the RC4 algorithm.
If the bot does detect the presence of either a debugger or a virtual machine, it decrypts the dummy code. This code copies itself under %alluserprofiles% as svchost.exe with hidden system file attributes.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
It then calls QueueUserAPC, which creates an asynchronous procedure call object. This object points to the code which decrypts some encrypted strings using RC4 decryption.
Eventually, in all versions, the loader injects the payload into a remote process using a process hollowing technique and runs it in memory.
It uses this path to create a copy of the original file before deleting it, and saves it in %alluserprofile% with a random filename... The original file in the old path is deleted.
In these variants, the loader enumerates the processes running on the machine and compares them against a list of unwanted processes.
Iterating through process names and computing their CRC32 hash values... Trying to load the libraries guard32.dll and sbiedll.dll... Querying for a value... to search for the presence of any virtual machine.
This code copies itself under %alluserprofiles% as svchost.exe with hidden system file attributes.
As part of its evolution, version 2.07 implements a custom exception handler using a call to SetUnhandledExceptionFilter. Similarly, version 2.08 calls RtlAddVectoredExceptionHandler and adds the custom handler as the first handler into the vectored exception handler chain (VEH).
Formbook ... can retrieve authorization and login credentials from a web data form before the information reaches a secure server, bypassing HTTPS encryption. ... Formgrabbers intercept HTTP(S) data and use inline hooking ... to capture a user's information before the user submits it
Querying for a value in the system\currentcontrolset\services\disk\enum registry to search for the presence of any virtual machine.
The main aim of Andromeda's payload is to steal the infected system's information, talk to the command-and-control (C&C) server, and download and install additional malware onto the system.
In these variants, the loader enumerates the processes running on the machine and compares them against a list of unwanted processes.
Formbook ... can retrieve authorization and login credentials from a web data form before the information reaches a secure server, bypassing HTTPS encryption. ... Formgrabbers intercept HTTP(S) data and use inline hooking ... to capture a user's information before the user submits it
As shown in Table 2, each version has two message formats, both sent as HTTP POST requests: Action Request and Task Report.
As shown in Table 2, each version has two message formats, both sent as HTTP POST requests: Action Request and Task Report.
The hooked GetAddrInfoW API performs a DNS query for the input host name from Google DNS server 8.8.4.4... The DNS record received is then used for querying the C&C domain name.
248 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family associated with botnet activity; some variants behave as worms and spread via infected USB drives.
A commodity trojan, originally developed in 2011, observed re-emerging to target Ukraine public sector networks.
Referenced as an established malware family into which Socks5Systemz was integrated as a SOCKS5 proxy module.
A malware family used as part of a botnet, most commonly observed as a USB-spreading worm. It has been used to spread other malware, steal information, and perform activities such as click fraud.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.