Trusted Design

Gamarue dropping Lethic bot

概要

The Gamarue (aka Andromeda) botnet is a highly modular botnet family that allows attackers to take complete control of an infected system and perform a range of malicious activity by downloading additional payloads. In this blog, we will cover a recent Gamarue infection that we looked at, which downloads and installs the Lethic bot on an infected system.

Created: 2026-02-23

Indicators

• URL - http://155.133.18.45/85fjr73.exe -
• URL - http://155.133.18.45/dq40a361.exe -
• FileHash-MD5 - f909be6b96c10e36f3c5b9e676f49c7e -
• URL - http://155.133.18.45/dqfjr73.exe -
• URL - http://155.133.18.45/nut40a361.exe -

類似Pulses

• GamaPoS: The Andromeda Botnet Connection (score: 0.80)
• Andromeda Botnet (score: 0.75)
• Botnet - Fluxerbot (score: 0.64)
• Gamarue/Andromeda Comeback (score: 0.62)
• Andromeda Botnet Targets Italy in Recent Spam Campaigns (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る