Description
Gamarue (a.k.a. Andromeda) is a modular botnet that spreads through spam, exploit kits, and infected removable drives, and it installs additional malware families on infected systems. Its downloader behavior made it a major distribution platform for information stealers, ransomware, and remote access trojans, and its infrastructure survived many years of churn before an international takedown in 2017. Variants and reused code continue to appear in modern campaigns.
Stats
- First seen
- June 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Email-MIME.Worm.Gamarue |
| Generic.LNK.Gamarue.B.4309B94F |
| Trojan.Gamarue.CF |
| Trojan.Gamarue.E |
| Trojan.Gamarue.ED |
| Trojan.Gamarue.F |
| Win32.Worm.Gamarue |
| Worm.Gamarue.E |
| Worm.Gamarue.I |