TA505 begins summer campaigns with a new pet malware downloader, AndroMut

Overview

Throughout 2018, Proofpoint researchers observed threat actors increasingly distributing downloaders, backdoors, information stealers, remote access trojans (RATs), and more as they abandoned ransomware as their primary payload. In November 2018, TA505, a prolific actor that has been at the forefront of this trend, began distributing a new backdoor we named “ServHelper”. ServHelper has two variants: one focused on remote desktop functions and a second that primarily functioned as a downloader.

In June 2019, TA505 appears to have introduced yet another new downloader malware, AndroMut, which has some similarities in code and behavior to Andromeda, a long-established malware family. Proofpoint research has observed AndroMut download malware referred to as “FlawedAmmyy.” FlawedAmmyy is a full-featured RAT that was first observed in early 2016 and is based on the leaked source code of a legitimate shareware tool, Ammyy.

• Also Read: Leaked Ammyy Admin Source Code Turned into Malware
• Also Read: Andromeda Under the Microscope (Avast)

Campaign Analysis

Proofpoint researchers observed two distinct campaigns by TA505 that used AndroMut to download FlawedAmmyy.

The first campaign used the following message details to target recipients in South Korea:

Sender Name:

• 백승기

Subject:

• 쌍용 인보이스 1234

URLs

• See IOCs

Sender Name:

• 최성은

Subject:

• 송금증 $123.12

Attachment Names:

• 20.06.2019 송금증 123.12.doc
• 20.06.2019 송금증 123.12.xls
• 20.06.2019 송금증 123.12.htm
• 20.06.2019 송금증 123.12.html

Sender Name:

• “Kim, DongHoon (Dongtan_Con)”

Subject:

• 견적서

Attachment Names:

• Cml-123456-1.xls

For more, click here.