ANDROMEDA

Andromeda, also widely known as Gamarue and Wauchos, is a modular Windows bot malware family first observed in 2011 and active for years as a criminal malware-as-a-service and botnet platform. It is best known as an HTTP-based bot used to profile infected systems, maintain command-and-control communications, download and execute additional payloads, install plug-ins, update itself, and remove components on operator command. The family was heavily used as a distribution layer for other malware and appeared in multiple criminal ecosystems, including exploit-kit-driven infections and spam-delivered campaigns. It was also associated with broader botnet operations and later disruption efforts around 2017.

Andromeda commonly infected victims through exploit kits hosted on compromised websites, and it was also observed as an attachment or intermediate payload in email-borne malware campaigns. Some variants spread through infected USB media and worm-like abuse of Windows shortcut files, contributing to its broad reach. Once executed, Andromeda typically unpacked a small loader that used obfuscated API resolution, anti-debugging, anti-virtualization, and anti-analysis checks before injecting its payload into remote processes. Process hollowing and related in-memory execution were core traits, and later variants added stronger self-defense, watchdog behavior, persistence restoration, inline API hooking, and stealthier inter-process coordination.

Its command-and-control protocol used HTTP POST traffic with encrypted tasking and reporting. Across versions, Andromeda used RC4-based protection for outbound and inbound data, with later variants changing message formats and encryption details, including JSON-based structures in newer builds. Supported tasking included downloading and running executables, loading plug-ins, installing or deleting DLL-based components, self-updating, and uninstalling itself. The malware also gathered host metadata for bot identification and operational management.

Andromeda was frequently used as a first-stage delivery mechanism for other malware families, including banking trojans, credential stealers, spam bots, remote access tools, and DDoS bots. It has been linked in reporting to delivery chains involving UrlZone, Chthonic, Pony, Pushdo, Neutrino Bot, Proteus, and CoalaBot, among others. Criminal groups and affiliates, including actors tied to large spam and exploit-kit operations, used it as rentable infrastructure. Its prevalence, modularity, and role as a malware distribution platform made it one of the more significant commodity botnets of its era.