SYMBOLCOMMON_NAMEaka. SYNONYMS
win.andromut (Back to overview)

AndroMut

aka: Gelup

Actor(s): TA505


There is no description at this point.

References
2020-12-14BluelivAlberto Marín, Carlos Rubio, Blueliv Labs Team
@online{marn:20201214:using:e81621e, author = {Alberto Marín and Carlos Rubio and Blueliv Labs Team}, title = {{Using Qiling Framework to Unpack TA505 packed samples}}, date = {2020-12-14}, organization = {Blueliv}, url = {https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/using-qiling-framework-to-unpack-ta505-packed-samples/}, language = {English}, urldate = {2020-12-15} } Using Qiling Framework to Unpack TA505 packed samples
AndroMut Azorult Silence TinyMet
2020-08-20CERT-FRCERT-FR
@techreport{certfr:20200820:development:d518522, author = {CERT-FR}, title = {{Development of the Activity of the TA505 Cybercriminal Group}}, date = {2020-08-20}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf}, language = {English}, urldate = {2020-08-28} } Development of the Activity of the TA505 Cybercriminal Group
AndroMut Bart Clop Dridex FlawedAmmyy FlawedGrace Get2 Locky Marap QuantLoader SDBbot ServHelper tRat TrickBot
2020-06-22CERT-FRCERT-FR
@techreport{certfr:20200622:volution:fba1cfa, author = {CERT-FR}, title = {{Évolution De Lactivité du Groupe Cybercriminel TA505}}, date = {2020-06-22}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf}, language = {French}, urldate = {2020-06-24} } Évolution De Lactivité du Groupe Cybercriminel TA505
Amadey AndroMut Bart Clop Dridex FlawedGrace Gandcrab Get2 GlobeImposter Jaff Locky Marap Philadephia Ransom QuantLoader Scarab Ransomware SDBbot ServHelper Silence tRat TrickBot
2020-05-24Positive TechnologiesPT ESC Threat Intelligence
@online{intelligence:20200524:operation:2ce432b, author = {PT ESC Threat Intelligence}, title = {{Operation TA505: network infrastructure. Part 3.}}, date = {2020-05-24}, organization = {Positive Technologies}, url = {https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part3/}, language = {English}, urldate = {2020-11-23} } Operation TA505: network infrastructure. Part 3.
AndroMut Buhtrap SmokeLoader
2020-05-21Intel 471Intel 471
@online{471:20200521:brief:048d164, author = {Intel 471}, title = {{A brief history of TA505}}, date = {2020-05-21}, organization = {Intel 471}, url = {https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/}, language = {English}, urldate = {2020-05-23} } A brief history of TA505
AndroMut Bart Dridex FlawedAmmyy FlawedGrace Gandcrab Get2 GlobeImposter Jaff Kegotip Locky Necurs Philadephia Ransom Pony QuantLoader Rockloader SDBbot ServHelper Shifu Snatch TrickBot
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare Axiom
2020-02-13QianxinQi Anxin Threat Intelligence Center
@techreport{center:20200213:report:146d333, author = {Qi Anxin Threat Intelligence Center}, title = {{APT Report 2019}}, date = {2020-02-13}, institution = {Qianxin}, url = {https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf}, language = {English}, urldate = {2020-02-27} } APT Report 2019
Chrysaor Exodus Dacls elf.vpnfilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2019-07-04Trend MicroTrend Micro
@techreport{micro:20190704:latest:dd6099a, author = {Trend Micro}, title = {{Latest Spam Campaigns from TA505 Now Using New Malware Tools Gelup and FlowerPippi}}, date = {2019-07-04}, institution = {Trend Micro}, url = {https://documents.trendmicro.com/assets/Tech-Brief-Latest-Spam-Campaigns-from-TA505-Now-Using-New-Malware-Tools-Gelup-and-FlowerPippi.pdf}, language = {English}, urldate = {2020-01-13} } Latest Spam Campaigns from TA505 Now Using New Malware Tools Gelup and FlowerPippi
AndroMut
2019-07-02ProofpointMatthew Mesa, Dennis Schwarz, Proofpoint Threat Insight Team
@online{mesa:20190702:ta505:7f99961, author = {Matthew Mesa and Dennis Schwarz and Proofpoint Threat Insight Team}, title = {{TA505 begins summer campaigns with a new pet malware downloader, AndroMut, in the UAE, South Korea, Singapore, and the United States}}, date = {2019-07-02}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/ta505-begins-summer-campaigns-new-pet-malware-downloader-andromut-uae-south}, language = {English}, urldate = {2019-11-26} } TA505 begins summer campaigns with a new pet malware downloader, AndroMut, in the UAE, South Korea, Singapore, and the United States
AndroMut FlawedAmmyy
Yara Rules
[TLP:WHITE] win_andromut_auto (20210616 | Detects win.andromut.)
rule win_andromut_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.andromut."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromut"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a01 68???????? ffd0 85c0 74e1 68d0070000 }
            // n = 6, score = 200
            //   6a01                 | push                1
            //   68????????           |                     
            //   ffd0                 | call                eax
            //   85c0                 | test                eax, eax
            //   74e1                 | je                  0xffffffe3
            //   68d0070000           | push                0x7d0

        $sequence_1 = { ffd0 8b15???????? 8d45e4 8b0d???????? 50 53 53 }
            // n = 7, score = 200
            //   ffd0                 | call                eax
            //   8b15????????         |                     
            //   8d45e4               | lea                 eax, dword ptr [ebp - 0x1c]
            //   8b0d????????         |                     
            //   50                   | push                eax
            //   53                   | push                ebx
            //   53                   | push                ebx

        $sequence_2 = { 56 6800000040 51 ffd0 898584f0ffff 83f8ff }
            // n = 6, score = 200
            //   56                   | push                esi
            //   6800000040           | push                0x40000000
            //   51                   | push                ecx
            //   ffd0                 | call                eax
            //   898584f0ffff         | mov                 dword ptr [ebp - 0xf7c], eax
            //   83f8ff               | cmp                 eax, -1

        $sequence_3 = { 59 50 56 8d4dd4 e8???????? 837de810 }
            // n = 6, score = 200
            //   59                   | pop                 ecx
            //   50                   | push                eax
            //   56                   | push                esi
            //   8d4dd4               | lea                 ecx, dword ptr [ebp - 0x2c]
            //   e8????????           |                     
            //   837de810             | cmp                 dword ptr [ebp - 0x18], 0x10

        $sequence_4 = { 3db7000000 7513 8d4dc8 8d5102 668b01 83c102 }
            // n = 6, score = 200
            //   3db7000000           | cmp                 eax, 0xb7
            //   7513                 | jne                 0x15
            //   8d4dc8               | lea                 ecx, dword ptr [ebp - 0x38]
            //   8d5102               | lea                 edx, dword ptr [ecx + 2]
            //   668b01               | mov                 ax, word ptr [ecx]
            //   83c102               | add                 ecx, 2

        $sequence_5 = { e8???????? ffd0 8d85ecfbffff 8bce 53 50 e8???????? }
            // n = 7, score = 200
            //   e8????????           |                     
            //   ffd0                 | call                eax
            //   8d85ecfbffff         | lea                 eax, dword ptr [ebp - 0x414]
            //   8bce                 | mov                 ecx, esi
            //   53                   | push                ebx
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_6 = { 83c410 85c0 7512 ffb590f9ffff b944acc281 e8???????? ffd0 }
            // n = 7, score = 200
            //   83c410               | add                 esp, 0x10
            //   85c0                 | test                eax, eax
            //   7512                 | jne                 0x14
            //   ffb590f9ffff         | push                dword ptr [ebp - 0x670]
            //   b944acc281           | mov                 ecx, 0x81c2ac44
            //   e8????????           |                     
            //   ffd0                 | call                eax

        $sequence_7 = { 8bfa c745e0ab03a543 c745e4a183a543 33f6 c745e8a183a443 c745ecafc3b003 c745f0b303a583 }
            // n = 7, score = 200
            //   8bfa                 | mov                 edi, edx
            //   c745e0ab03a543       | mov                 dword ptr [ebp - 0x20], 0x43a503ab
            //   c745e4a183a543       | mov                 dword ptr [ebp - 0x1c], 0x43a583a1
            //   33f6                 | xor                 esi, esi
            //   c745e8a183a443       | mov                 dword ptr [ebp - 0x18], 0x43a483a1
            //   c745ecafc3b003       | mov                 dword ptr [ebp - 0x14], 0x3b0c3af
            //   c745f0b303a583       | mov                 dword ptr [ebp - 0x10], 0x83a503b3

        $sequence_8 = { 0f4345e4 50 ff15???????? 56 6a01 8d4de4 e8???????? }
            // n = 7, score = 200
            //   0f4345e4             | cmovae              eax, dword ptr [ebp - 0x1c]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   56                   | push                esi
            //   6a01                 | push                1
            //   8d4de4               | lea                 ecx, dword ptr [ebp - 0x1c]
            //   e8????????           |                     

        $sequence_9 = { 8d8570f9ffff b9c6968752 50 e8???????? ffd0 6a04 8d85d8fbffff }
            // n = 7, score = 200
            //   8d8570f9ffff         | lea                 eax, dword ptr [ebp - 0x690]
            //   b9c6968752           | mov                 ecx, 0x528796c6
            //   50                   | push                eax
            //   e8????????           |                     
            //   ffd0                 | call                eax
            //   6a04                 | push                4
            //   8d85d8fbffff         | lea                 eax, dword ptr [ebp - 0x428]

    condition:
        7 of them and filesize < 368640
}
Download all Yara Rules