Russian 'Gamaredon' Hackers Use 8 New malware payloads in attacks
Reading Time: 2 minutes

Russian ‘Gamaredon’ hackers use 8 new malware payloads in attacks. The hacking group is also known as Armageddon or Shuckworm is believed to be operated directly by the Russian FSB(Federal Security Service) and is responsible for numerous attacks in Ukraine since 2013. 

According to Symantec’s Threat Hunter team, a part of Broadcom Software, around 8 malware samples were used by Gamaredon against Ukrainian in recent malware attacks that can provide essential information for defenders to protect against the ongoing wave attacks.

Symantec in a report said the attacks started in July with the distribution of spear-phishing emails that carried macro laced Word documents. These files launched a VBS file that dropped a backdoor called “Pteranodon” that Gamaredon has been developing and improving for almost seven years now.

While the recent attacks are being conducted using phishing emails, they drop 8 different payloads. 

Russian ‘Gamaredon’ Hackers 8 New malware payloads in attacks
Symantec has analyzed all eight files from the recent Gamaredon attacks. These files are 7-zip self-extracting binaries that minimize user-interaction requirements.

  1. descend.exe – Executes to drop a VBS file on “%USERPROFILE%\Downloads\deerbrook.ppt” and “%PUBLIC%\Pictures\deerbrook.ppt”, and creates a scheduled task on the compromised system. The VBS contacts the C2 and fetches the payload.
  2. deep-sunken.exe – The downloaded payload which executes to drop four more files on the compromised computer: baby.cmd, baby.dat, basement.exe (wget binary), vb_baby.vbs. A new scheduled task is created and the C2 is contacted again for the next payload.
  3. z4z05jn4.egf.exe – Next-stage payload which is similar to the previous one but features different C2, drops files in different folders, and uses different filenames.
  4. defiant.exe – Executes to drop VBS files onto “%TEMP%\\deep-versed.nls” and “%PUBLIC\Pictures\deep-versed.nls”, and then create a scheduled task for their execution.
  5. deep-green.exe – UltraVNC remote administration tool that connects to a repeater.
  6. deep-green.exe – Process Explorer binary for Microsoft Windows.
  7. deep-green.exe – Same as defiant.exe but with different hard-coded C2 and filenames.
  8. deep-green.exe – Drops VBS in “%PUBLIC%\Music\” and creates a scheduled task that searches for removable drives on the infected system.

The other signs of compromise include C2 URLs and IPs allocated by the AS9123 TimeWeb Ltd., and they all use a unique URI structure as shown below:

  • http + IP + /.php?=, OR
  • http + IP + /.php?=,-

While the most common directories that host malicious files are as follows:

  • csidl_profile\links
  • csidl_profile\searches
  • CSIDL_PROFILE\appdata\local\temp\
  • CSIDL_PROFILE\

Symantec concluded by saying that many of the dropped files have unknown parent process hashes that were not analyzed. As a result of this, parts of the Gamaredon operation remain unclear. You can find the file hashes of the new malware payloads found by Symantec in the report.

Related Articles:
Are you Embedding Google Fonts on your Websites? German Court Rules it Violets GDPR
New Microsoft Bug Allows Bad Actors to Take Complete Control of Your Emails
2FA Authenticator – Delete this Android App Before it Cleans out Your Bank Account