Eric.freyssinet: Created page with "{{Publication |Botnet=Gamarue, Lethic, |Feature=Custom packer, |Vector=Gamarue, |Group=Spamming, |Year=2015 |Date=2015-06-11 |Editor=Zscaler |Link=http://research.zscaler.com/..."

2015-07-18T12:36:20Z

Created page with "{{Publication |Botnet=Gamarue, Lethic, |Feature=Custom packer, |Vector=Gamarue, |Group=Spamming, |Year=2015 |Date=2015-06-11 |Editor=Zscaler |Link=http://research.zscaler.com/..."

New page

{{Publication
|Botnet=Gamarue, Lethic,
|Feature=Custom packer,
|Vector=Gamarue,
|Group=Spamming,
|Year=2015
|Date=2015-06-11
|Editor=Zscaler
|Link=http://research.zscaler.com/2015/06/gamarue-dropping-lethic-bot.html
|Author=Amandeep Kumar, Nirmal Singh,
|Type=Blogpost
|Abstract=The Gamarue (aka Andromeda) botnet is a highly modular botnet family that allows attackers to take complete control of an infected system and perform a range of malicious activity by downloading additional payloads. In this blog, we will cover a recent Gamarue infection that we looked at, which downloads and installs the Lethic bot on an infected system.

The Lethic botnet has been known to be involved in pharmaceutical and replica spam since it's inception as was detailed by Arbor Networks here. Neither of these botnets are new and have both survived takedown attempts by authorities. The Gamarue infection in our case was leading to the download of Lethic bot from the following URLs:
}}

Gamarue dropping Lethic bot - Revision history

Eric.freyssinet: Created page with "{{Publication |Botnet=Gamarue, Lethic, |Feature=Custom packer, |Vector=Gamarue, |Group=Spamming, |Year=2015 |Date=2015-06-11 |Editor=Zscaler |Link=http://research.zscaler.com/..."