Gamarue dropping Lethic bot

(Publication) Google search: [1]

Gamarue dropping Lethic bot
Botnet	Gamarue, Lethic
Malware
Botnet/malware group	Spamming
Exploit kits
Services
Feature	Custom packer
Distribution vector	Gamarue
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2015 / 2015-06-11
Editor/Conference	Zscaler
Link	http://research.zscaler.com/2015/06/gamarue-dropping-lethic-bot.html (Archive copy)
Author	Amandeep Kumar, Nirmal Singh
Type	Blogpost

Abstract

“ The Gamarue (aka Andromeda) botnet is a highly modular botnet family that allows attackers to take complete control of an infected system and perform a range of malicious activity by downloading additional payloads. In this blog, we will cover a recent Gamarue infection that we looked at, which downloads and installs the Lethic bot on an infected system.

The Lethic botnet has been known to be involved in pharmaceutical and replica spam since it's inception as was detailed by Arbor Networks here. Neither of these botnets are new and have both survived takedown attempts by authorities. The Gamarue infection in our case was leading to the download of Lethic bot from the following URLs:

Bibtex

 @misc{2015BFR1635,
   editor = {Zscaler},
   author = {Amandeep Kumar, Nirmal Singh},
   title = {Gamarue dropping Lethic bot},
   date = {11},
   month = Jun,
   year = {2015},
   howpublished = {\url{http://research.zscaler.com/2015/06/gamarue-dropping-lethic-bot.html}},
 }