Sekoia Details Gamaredon’s Three-Stage GammaLoad Chain
Summary
Sekoia analyzes Gamaredon’s three-stage GammaLoad chain, which caches C2 URLs in the Windows registry, falls back to dead drop resolvers on legitimate services, uses a scheduled task, and loads the GammaSteel stealer in memory.
Key points
- Sekoia says its investigation combined more than 70 artifacts with live interactions with Gamaredon’s C2 staging infrastructure.
- GammaLoad uses three loader stages: VBScript loaders lead to a PowerShell loader that retrieves and runs the final payload.
- The first stage fingerprints the host using its computer name and system-drive serial number.
- GammaLoad caches active C2 configuration under HKCU\Console and can fall back to dead drop resolvers hosted on services including Telegraph, Telegram, and Check-Host.
- The second stage writes a payload to an Alternate Data Stream under %TEMP% and creates a scheduled task configured to run it every 11 minutes.
- The third stage launches hidden PowerShell, decodes and XOR-decrypts a fetched payload, then executes it in memory; Sekoia identifies the final payload as the GammaSteel stealer.
Article Details
- Attack Vectors
- GammaLoad uses a three-stage VBScript loader chain, with cached C2 URLs in HKCU\Console and fallback to Dead Drop Resolvers hosted on third-party services.
- The second-stage dropper writes a loader to an Alternate Data Stream in %TEMP% and creates a scheduled task to run it every 11 minutes.
- The third stage launches a hidden PowerShell process, retrieves a Base64-encoded payload, XOR-decrypts it, and executes it in memory.
- The first-stage loader fingerprints hosts using the computer name and system-drive serial number, embedding the values in a crafted User-Agent string.
- Defensive Notes
- The article identifies HKCU\Console values HistoryURL, WindowsResponby, CloudURL, and IpURL as locations used to cache or update C2 configuration.
- Monitor for the scheduled task \Windows\ApplicationData\DsSvcCleanup and execution of an Alternate Data Stream under %TEMP%.
- The analyzed loaders use obfuscation including Base64, ROT13, and XOR; the PowerShell stage disables SSL certificate validation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dayobtvoyu[.]ru | The article identifies this as the second-stage dropper’s hardcoded domain. |
| IPV4 | 139[.]162[.]90[.]180 | IP address listed as C2 infrastructure for the GammaLoad infection chain. |
| IPV4 | 172[.]86[.]127[.]216 | IP address listed as C2 infrastructure for the GammaLoad infection chain. |
| IPV4 | 172[.]86[.]72[.]243 | Hardcoded C2 address written by the second-stage dropper to the Windows registry. |
| IPV4 | 172[.]86[.]76[.]132 | IP address extracted by a Dead Drop Resolver and used as an active C2 URL. |
| IPV4 | 89[.]185[.]82[.]188 | IP address listed as C2 infrastructure for the GammaLoad infection chain. |
| MD5 | a2c6e01001c62f6198e31a9d603977c6 | MD5 of the analyzed second-stage GammaLoad dropper. |
| MD5 | bf94f4056627907d86ce1cae8b44c67a | MD5 of the analyzed first-stage GammaLoad VBScript loader. |
| MD5 | d2a6009587b3cb73355c2d1e53d5cdfa | MD5 of the analyzed third-stage GammaLoad VBScript loader. |
| URL | hxxp[:]//check-host[.]net/ip-info?host=sngredient.selltosell.ru | Specific Check-Host Dead Drop Resolver URL listed for resolving GammaLoad C2 infrastructure. |
| URL | hxxp[:]//iguessillgoout[.]myvnc[.]com | C2 URL listed by the article for the GammaLoad infection chain. |
| URL | hxxp[:]//lateinsomnia[.]ru | C2 URL listed by the article for the GammaLoad infection chain. |
| URL | hxxps[:]//aws[.]amazon[.]com@surgud[.]online/clonus | C2 URL listed by the article; the URL’s destination host is surgud[.]online. |
| URL | hxxps[:]//bold[.]zsjtn41091[.]workers[.]dev | C2 URL listed by the article for the GammaLoad infection chain. |
| URL | hxxps[:]//check-host[.]net/ip-info?host=norosta.ru | Specific Check-Host Dead Drop Resolver URL listed for resolving GammaLoad C2 infrastructure. |
| URL | hxxps[:]//check-host[.]net/ip-info?host=snterval.selltosell.ru | Check-Host Dead Drop Resolver URL used to retrieve a C2 address. |
| URL | hxxps[:]//insight-sweet-drainage-appreciated[.]trycloudflare[.]com/log/ | C2 endpoint used by the researchers to retrieve the final GammaSteel payload. |
| URL | hxxps[:]//lesma[.]eu/qowuzeco?raw | URL listed among the Dead Drop Resolvers used by the GammaLoad chain. |
| URL | hxxps[:]//pdt-resulting-hospitality-mesh[.]trycloudflare[.]com | C2 URL listed by the article for the GammaLoad infection chain. |
| URL | hxxps[:]//te[.]legra[.]ph/auuoyeipkudjgjnw-01-17 | Specific Telegraph Dead Drop Resolver URL listed for resolving GammaLoad C2 infrastructure. |
| URL | hxxps[:]//te[.]legra[.]ph/fxpppscdlw-12-27 | Telegraph Dead Drop Resolver URL used to retrieve a C2 address. |
| URL | hxxps[:]//telegram[.]me/s/akatachi | Telegram Dead Drop Resolver URL used to retrieve a C2 address. |
| URL | hxxps[:]//telegram[.]me/s/oberfarir | Specific Telegram Dead Drop Resolver URL listed for resolving GammaLoad C2 infrastructure. |
| URL | hxxps[:]//vids-road-christina-guards[.]trycloudflare[.]com | C2 endpoint used to retrieve the loader executed by the scheduled task. |
| URL | hxxps[:]//wandering[.]lexkv18877[.]workers[.]dev | C2 URL listed by the article for the GammaLoad infection chain. |
| URL | hxxps[:]//white[.]febul89300[.]workers[.]dev/ | C2 URL listed by the article for the GammaLoad infection chain. |
| URL | hxxps[:]//www[.]az[.]com@sweet[.]csxvl00328[.]workers[.]dev/vehis | C2 endpoint used to retrieve the second-stage GammaLoad dropper. |
| URL | hxxps[:]//www[.]huaweicloud[.]com@e097[.]yggjf81487[.]workers[.]dev/libertarian | Dead Drop Resolver response yielded this attacker-controlled C2 URL. |
| URL | hxxps[:]//www[.]telegram[.]me/s/bicotipus | Specific Telegram Dead Drop Resolver URL listed for resolving GammaLoad C2 infrastructure. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe second-stage dropper creates a scheduled task that executes the ADS loader every 11 minutes.T1059.001 · PowerShellThe third stage launches PowerShell to retrieve, decode, decrypt, and execute the final payload.T1059.005 · Visual BasicThe GammaLoad stages are VBScript loaders that execute additional scripts.T1082 · System Information DiscoveryThe first-stage loader collects the computer name and system-drive serial number to fingerprint the host.T1102.001 · Dead Drop ResolverThe loader uses specific Telegraph, Telegram, and Check-Host resources as Dead Drop Resolvers for C2 addresses.T1105 · Ingress Tool TransferThe loaders retrieve successive payload stages from C2 endpoints and Dead Drop Resolvers.T1112 · Modify RegistryThe loaders read and update C2 configuration values under HKCU\Console in the Windows registry.T1140 · Deobfuscate/Decode Files or InformationThe loaders decode Base64 and ROT13 content and XOR-decrypt the retrieved payload before execution.T1564.003 · Hidden WindowThe third stage stores a loader in an Alternate Data Stream under %TEMP%.
Threat Actors
ArmagedonThe article identifies Armagedon as another name for Gamaredon, which it attributes with operating the GammaLoad infection chain.GamaredonThe article attributes the GammaLoad infection chain and its deployment of GammaSteel to Gamaredon, described as an FSB-operated intrusion set.UAC-0010The article identifies UAC-0010 as another name for Gamaredon, which it attributes with operating the GammaLoad infection chain.
Malware
GammaLoadFSB’s matryoshka #2/3 - Gamaredon’s gifts that keeps unpacking - GammaLoadGammaPhishFSB’s matryoshka #1/3 - GammaPhish and GammaWormGammaSteelThe three stages ultimately fetch and run GammaSteel in memory, the stealer analysed in the final report of the series.GammaWormFSB’s matryoshka #1/3 - GammaPhish and GammaWorm
Products
Microsoft WindowsThe chain caches its active C2 configuration in the Windows registry and falls back to Dead Drop Resolvers when needed.PowerShellThird Stage (PowerShell loader): Executed regularly by the scheduled task, this obfuscated loader spawns a hidden PowerShell process. It fetches, XOR-decrypts, and executes the payload in-memory.