The Gamaredon group has been active since at least 2013. Outlook VBA module . The Gamaredon group uses a package that includes a custom Microsoft Outlook Visual Basic for Applications (VBA) project. The most prevalent tools downloaded and installed on compromised machines can be broadly grouped into two different categories: downloaders and backdoors. C# compiler module . This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript. It also has the ability to download and execute arbitrary code from its C&C server. C# backdoor thread creation routine . Batch file/VBScript . This version comprises several scripts, written in both batch file form and VBScript. Network infrastructure . The Gamaredon group uses many different domains, both free and paid, for its C&C servers. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Indicators of Compromise (IoCs) . MITRE ATT&CK techniques . 11 Jun 2020 - 11:30AM . Newsletter . Newsletter . Similar Articles . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Some URL shortener services distribute Android malware, including banking or SMS trojans . Discussion . - Home - About Us - Contact Us - Sitemap - Our Experts - ESET - Research - How To - Categories - RSS Configurator - News Widget