Skip Navigation
Get a Demo
 
 
 
 
 
 
 
 
 
 

threat

Gamarue

More than five years after a major disruption, Gamarue is still worming around, often spreading dangerous payloads.

Pairs with this song

#7

overall rank

3.1%

customers affected
 

Analysis Icon

Analysis

Gamarue, sometimes referred to as Andromeda or Wauchos, is a malware family used as part of a botnet. The variant of Gamarue we observe most frequently is a worm that spread primarily via infected USB drives. Gamarue has been used to spread other malware, steal information, and perform other activities such as click fraud.

It might seem unusual that Gamarue continues to be so prevalent given that it was disrupted in 2017. However, its presence in our top 10 threats tells us how pervasive worms can be, even years after takedowns of much of their command and control (C2) infrastructure. Although Gamarue isn’t as active as it once was, it isn’t completely gone, and therefore should still be taken seriously, as it may be a sign of poor security hygiene.

New names on the lease

Additionally, there is a risk of other adversaries taking over old Gamarue infrastructure and using it for their own nefarious purposes. Mandiant reported that the Turla Team, tracked under the name UNC4210, did exactly that in 2022—the actors re-registered expired Gamarue domains and used them to profile victims that they later targeted with follow-on malware.

USB threats: Underlooked Security Burdens

With so many threats facing us, USB worms aren’t often the highest priority for many security teams, but they are still worth your attention. While we didn’t see follow-on activity in most Gamarue detections, the fact that we observed Gamarue in so many environments is significant because it tells us that USB worms are still a pervasive infection vector that we need to consider as part of our threat models. Other threats that spread via USB like Raspberry Robin also highlight this threat vector. While we as security practitioners may think “no one uses USB drives anymore,” our analysis shows that’s clearly not the case in many organizations, and we regularly observe infections starting from USB drives.

While detection of Gamarue is possible, ideally, organizations should take action to prevent USB infections altogether. There are multiple mitigation options, and the best one for each organization will depend on business needs for USB drives as well as the capacity for implementing these controls. As always, test these thoroughly before deploying into production:

 

Icon-threat detection

Detection opportunities

Fortunately for defenders, Gamarue is detectable with endpoint telemetry. The majority of Gamarue activity we see involves rundll32.exe executing with unusual command lines that include long filenames with repeating characters and random function names. Here are a couple examples of common command lines we observe:

rundll32.exe \aceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaccec.aceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaccec,IgADoIcwBkEYaMgE

rundll32.exe \----__--_-_--___---__---___-___--__---_-_____-_-----_--.----__--_-_--___---__---___-___--__---_-_____-_-----_--,L1yJvXAtVNnT5pV8

Here is pseudocode for a detection analytic that would detect these command lines:

process == rundll32 
&& 
deobfuscated_command_includes ('/\S{10,70}\.\S{10,70},\w{16}/')*

Note: This regular expression looks for a pattern of between 10-70 non-whitespace characters followed by a period followed by 10-70 more non-whitespace characters, followed by a comma, followed by 16 word characters.

Testing Icon

Testing

Start testing your defenses against Gamarue using Atomic Red Team—an open source testing framework of small, highly portable detection tests mapped to MITRE ATT&CK.

Getting started

Atomic Red Team includes a long list of tests for Rundll32 tradecraft. While none of them perfectly emulate the detection logic described above, security teams can supply a custom DLL file that mimics the seemingly random filenames shown in the above command lines to validate their detection capabilities.

Review and repeat

Now that you have executed one or several common tests and checked for the expected results, it’s useful to answer some immediate questions:

  • Were any of your actions detected?
  • Were any of your actions blocked or prevented?
  • Were your actions visible in logs or other defensive telemetry?

Repeat this process, performing additional tests related to this technique. You can also create and contribute tests of your own.

 
 
Back to Top