Andromeda

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Andromeda
Alias	Gamarue
Group	Banking
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: GamaPoS, Gamarue dropping Lethic bot, Lethic, New GamaPoS malware piggybacks on Andromeda botnet; spreads in 13 US states, New point-of-sale malware distributed by Andromeda botnet Campaigns: Anunak
Target	Microsoft Windows
Origin
Distribution vector	Smoke Bot
UserAgent	Mozilla/4.0
CCProtocol	HTTP (Centralized)
Activity	2011-09 / Unknown
Status
Language
Programming language
Operation/Working group

Introduction

Andromeda est un botnet basé sur HTTP qui inclus

Plugins :

• Keyloggers
• Form grabbers
• SOCKS4 proxy module
• Rootkits

Features

• File download

Publications

	Author	Editor	Year
Andromeda 2.7 features	Suweera De Souza	Fortinet	2014
Exploring the market for stolen passwords	Brian Krebs	Brian Krebs	2012
Gamarue dropping Lethic bot	Amandeep Kumar Nirmal Singh	Zscaler	2015
Get gamed and rue the day...	Methusela Cebrian Ferrer	Microsoft	2012
Inside Andromeda Bot v2.06 Webpanel / AKA Gamarue - Botnet Control Panel	Kafeine		2012
Large-scale analysis of malware downloaders	Christian Rossow Christian Dietrich Herbert Bosz	DIMVA	2012
MSRT march: three hioles in one	Shawn Wang	Microsoft	2012
Reversing Andromeda-Gamarue botnet	Rashid Bhatt	Garage 4 Hackers	2013
The Andromeda/Gamarue botnet is on the rise again	Paul Rascagnères	GData	2015