Gamarue
Overview
Executive Summary
Gamarue (also widely known as Andromeda) is a notorious, highly modular worm and botnet client. First detected around 2011, it was historically one of the most widespread malware families in the world, primarily sold as a Malware-as-a-Service (MaaS) kit on underground forums. While a massive international law enforcement operation dismantled the primary Andromeda botnet in 2017, legacy infections and new variants utilizing the leaked source code still pose a significant threat. Its primary function is to establish a persistent backdoor and download secondary payloads (like keyloggers or ransomware).Infection Vector and Technical Capabilities
Gamarue spreads via multiple vectors, making it highly contagious. Historically, it spread aggressively via infected removable drives (USB worms), but it is also heavily distributed via exploit kits (drive-by downloads) and malicious spam attachments. Its technical capabilities are focused on stealth and modular expansion:- USB Worm Propagation: Gamarue excels at local propagation. It copies itself to any connected USB drive, hiding the legitimate files and creating malicious `.lnk` (shortcut) files. When a user on another machine clicks the shortcut, the worm executes, infecting the new host.
- Process Injection and Hooking: Upon execution, Gamarue decrypts its payload in memory and injects it into legitimate Windows processes (like `wuauclt.exe` or `svchost.exe`). It hooks numerous Windows APIs to hide its files, registry keys, and network connections from the user and traditional AV (Rootkit functionality).
- Plugin Architecture: The core bot is merely a downloader. The Command and Control (C2) server can push specific plugins to the infected host, instantly turning it into a spam relay, a keylogger, a DDoS participant, or a banking credential stealer.
Threat Assessment
A Gamarue infection is a critical incident. The presence of the worm indicates a complete compromise of the endpoint. Because it is a modular loader, the machine is highly likely to be infected with numerous other, more destructive malware payloads downloaded by the botnet.Incident Response and Remediation
- Immediate Network and USB Isolation: The infected endpoint must be disconnected from the network immediately. Furthermore, all USB drives that were connected to the machine must be confiscated and securely wiped to prevent the worm from spreading further.
- Disable AutoRun/AutoPlay: Ensure that Windows AutoRun and AutoPlay features are completely disabled across the corporate domain via Group Policy, as this is the primary mechanism Gamarue uses to spread via USB.
- Total Re-imaging: Due to its extensive use of API hooking and process injection, cleaning a Gamarue infection is highly unreliable. The machine must be completely wiped to bare metal and re-imaged.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1091 T1055 T1056.001
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_GAMARUE {
meta:
description = "Detects Gamarue (loader)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "gamarue" ascii wide nocase
$s2 = "worm.gamarue" ascii wide nocase
$s3 = "botnet.andromeda" ascii wide nocase
$s4 = "win32/gamarue" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Gamarue Activity
id: b577e69d8a2a96828e9dee13345c3a5e
status: experimental
description: Detects generic indicators of the gamarue malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*gamarue*"
- "*worm.gamarue*"
- "*botnet.andromeda*"
- "*win32/gamarue*"
condition: selection
level: mediumReferences & External Analysis
- MITRE ATT&CK: ANDROMEDA (S1074)
- Search "gamarue" on VirusTotal (External Analysis)
Frequently Asked Questions
What is Gamarue/ANDROMEDA?
Commodity modular loader malware, widespread in the early 2010s, used to distribute other malware families.
Is ANDROMEDA still seen today?
Yes; MITRE notes continued observations, including a 2022 campaign where expired C2 domains were re-registered to target victims in Ukraine.
How did Gamarue spread?
Through removable drives, spam, and exploit kits.
What does ANDROMEDA do?
It acts as a loader, installing additional malware on infected machines.
Where is the authoritative reference?
MITRE ATT&CK's ANDROMEDA entry (S1074), linked on this page.
How do I remove the Gamarue Loader from Windows?
Manual removal of Gamarue is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Gamarue a virus or a Loader?
Gamarue is classified as a Loader. Unlike traditional viruses that infect files, modern malware like Gamarue typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Gamarue infection?
Symptoms of Gamarue can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: loader)
Explore other malware families in the same category:
Protect Your Network Against Loaders
Want to prevent Gamarue and similar threats from compromising your organization? Read our comprehensive defensive guide: Suspect an Infection? What to do.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/gamarue.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.