Gamarue

Analysis

Gamarue, sometimes referred to as Andromeda or Wauchos, is a malware family used as part of a botnet. The variant of Gamarue we observe most frequently is a worm that spread primarily via infected USB drives. Gamarue has been used to spread other malware, steal information, and perform other activities such as click fraud.

It might seem unusual that Gamarue continues to be so prevalent given that it was disrupted in 2017. However, its presence in our top 10 threats tells us how pervasive worms can be, even years after takedowns of much of their command and control (C2) infrastructure. Although Gamarue isn’t as active as it once was, it isn’t completely gone, and therefore should still be taken seriously, as it may be a sign of poor security hygiene.

New names on the lease

Additionally, there is a risk of other adversaries taking over old Gamarue infrastructure and using it for their own nefarious purposes. Mandiant reported that the Turla Team, tracked under the name UNC4210, did exactly that in 2022—the actors re-registered expired Gamarue domains and used them to profile victims that they later targeted with follow-on malware.

USB threats: Underlooked Security Burdens

With so many threats facing us, USB worms aren’t often the highest priority for many security teams, but they are still worth your attention. While we didn’t see follow-on activity in most Gamarue detections, the fact that we observed Gamarue in so many environments is significant because it tells us that USB worms are still a pervasive infection vector that we need to consider as part of our threat models. Other threats that spread via USB like Raspberry Robin also highlight this threat vector. While we as security practitioners may think “no one uses USB drives anymore,” our analysis shows that’s clearly not the case in many organizations, and we regularly observe infections starting from USB drives.

While detection of Gamarue is possible, ideally, organizations should take action to prevent USB infections altogether. There are multiple mitigation options, and the best one for each organization will depend on business needs for USB drives as well as the capacity for implementing these controls. As always, test these thoroughly before deploying into production:

• Manage Removable Storage Access Control using group policy to restrict read, write, and/or execute actions from USB devices.
• Enable the Windows attack surface reduction (ASR) rule to block untrusted and unsigned processes that run from USB devices.
• Disable AutoPlay on Windows to prevent automatic execution of files from USB devices.
• Investigate if your antivirus software has a feature to scan removable drives during mounting.

Detection opportunities

Fortunately for defenders, Gamarue is detectable with endpoint telemetry. The majority of Gamarue activity we see involves rundll32.exe executing with unusual command lines that include long filenames with repeating characters and random function names. Here are a couple examples of common command lines we observe:

rundll32.exe \aceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaccec.aceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaceaccec,IgADoIcwBkEYaMgE

rundll32.exe \----__--_-_--___---__---___-___--__---_-_____-_-----_--.----__--_-_--___---__---___-___--__---_-_____-_-----_--,L1yJvXAtVNnT5pV8

Here is pseudocode for a detection analytic that would detect these command lines: