ESET Gamaredon June 2020

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments. Additionally, Gamaredon Group has used an obfuscated .drv file.

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.

Gamaredon Group has used obfuscated or encrypted scripts.

Gamaredon Group has obfuscated .NET executables by inserting junk code.

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM. Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`.

Gamaredon Group's malware can take screenshots of the compromised computer every minute.

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gamaredon Group malware has used rundll32 to launch additional malicious components.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.