Gamaredon’s GammaLoad Uses Three-Stage Loader Chain to Deliver GammaSteel
Summary
Sekoia analyzes Gamaredon’s three-stage GammaLoad chain, which uses registry-cached C2 addresses and trusted services to retrieve payloads, establish scheduled-task execution, and load the GammaSteel stealer in memory.
Key points
- GammaLoad consists of three VBScript loader stages that ultimately retrieve and execute the GammaSteel stealer.
- The first stage fingerprints infected hosts and checks cached C2 URLs in the Windows registry before using Telegraph, Telegram, or Check-Host as dead-drop resolvers.
- Loaders store active C2 configuration under HKCU\Console and use randomized request paths and crafted User-Agent strings.
- The second stage writes a loader to an Alternate Data Stream in %TEMP% and creates a scheduled task to run it every 11 minutes.
- The third stage launches hidden PowerShell, retrieves a payload, Base64-decodes and XOR-decrypts it, then executes it in memory.
- Sekoia reports that the loaders themselves do not survive a reboot; persistence is likely established separately by Gamaredon.
- The activity is attributed to Gamaredon, an intrusion set described as FSB-operated and historically targeting Ukrainian government and critical infrastructure.
Article Details
- Attack Vectors
- GammaLoad is delivered as a multi-stage chain of VBScript loaders, with earlier stages attributed to GammaWorm or GammaPhish.
- The loaders retrieve subsequent payloads through cached C2 URLs or Dead Drop Resolvers hosted on Telegraph, Telegram, and Check-Host.
- The second stage writes a payload to an Alternate Data Stream in %TEMP% and creates a scheduled task to execute it every 11 minutes.
- The third stage launches hidden PowerShell, retrieves an encoded payload over HTTP, decodes and XOR-decrypts it, and executes it in memory.
- Defensive Notes
- Monitor HKCU\Console values HistoryURL, WindowsResponby, CloudURL, and IpURL for suspicious C2 configuration.
- Monitor for the scheduled task \Windows\ApplicationData\DsSvcCleanup and execution of an Alternate Data Stream in %TEMP%.
- Inspect hidden PowerShell executions using -nol, -nop, and -encodedcommand, including scripts that download, Base64-decode, XOR-decrypt, and execute content in memory.
- Review outbound requests to the listed C2 and Dead Drop Resolver indicators, including suspicious traffic using legitimate third-party services to retrieve C2 addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bold[.]zsjtn41091[.]workers[.]dev | C2 domain listed among GammaLoad indicators. |
| DOMAIN | dayobtvoyu[.]ru | Hardcoded domain used by the second-stage dropper as a Dead Drop Resolver. |
| DOMAIN | exemption-transportation-kilometers-berkeley[.]trycloudflare[.]com | C2 domain formed by appending the Dead Drop Resolver response string to .trycloudflare[.]com. |
| DOMAIN | pdt-resulting-hospitality-mesh[.]trycloudflare[.]com | C2 domain listed among GammaLoad indicators. |
| DOMAIN | sweet[.]csxvl00328[.]workers[.]dev | Attacker-used C2 hostname serving the second-stage loader. |
| DOMAIN | vids-road-christina-guards[.]trycloudflare[.]com | C2 domain written to the registry and used to retrieve the next loader. |
| DOMAIN | wandering[.]lexkv18877[.]workers[.]dev | C2 domain listed among GammaLoad indicators. |
| DOMAIN | white[.]febul89300[.]workers[.]dev | C2 domain listed among GammaLoad indicators. |
| IPV4 | 139[.]162[.]90[.]180 | C2 IP address listed among GammaLoad indicators. |
| IPV4 | 144[.]172[.]88[.]24 | C2 address returned by a Dead Drop Resolver. |
| IPV4 | 172[.]86[.]127[.]216 | C2 IP address listed among GammaLoad indicators. |
| IPV4 | 172[.]86[.]72[.]243 | C2 address written to the registry by the second-stage dropper. |
| IPV4 | 172[.]86[.]76[.]132 | C2 address returned by a Dead Drop Resolver and stored in the registry. |
| IPV4 | 89[.]185[.]82[.]188 | C2 IP address listed among GammaLoad indicators. |
| MD5 | a2c6e01001c62f6198e31a9d603977c6 | MD5 hash of the second-stage GammaLoad dropper. |
| MD5 | bf94f4056627907d86ce1cae8b44c67a | MD5 hash of the first-stage GammaLoad loader. |
| MD5 | d2a6009587b3cb73355c2d1e53d5cdfa | MD5 hash of the third-stage GammaLoad loader. |
| URL | hxxp[:]//check-host[.]net/ip-info?host=sngredient[.]selltosell[.]ru | Dead Drop Resolver URL listed among GammaLoad indicators. |
| URL | hxxp[:]//iguessillgoout[.]myvnc[.]com | C2 URL listed among GammaLoad indicators. |
| URL | hxxp[:]//lateinsomnia[.]ru | C2 URL listed among GammaLoad indicators. |
| URL | hxxps[:]//check-host[.]net/ip-info?host=norosta[.]ru | Dead Drop Resolver URL listed among GammaLoad indicators. |
| URL | hxxps[:]//check-host[.]net/ip-info?host=snterval[.]selltosell[.]ru | Dead Drop Resolver request used to obtain a C2 address. |
| URL | hxxps[:]//e097[.]yggjf81487[.]workers[.]dev/libertarian | C2 URL retrieved from a Dead Drop Resolver. |
| URL | hxxps[:]//insight-sweet-drainage-appreciated[.]trycloudflare[.]com/log/ | C2 URL queried to retrieve the final GammaSteel payload. |
| URL | hxxps[:]//lesma[.]eu/qowuzeco?raw | Dead Drop Resolver URL listed among GammaLoad indicators. |
| URL | hxxps[:]//surgud[.]online/clonus | C2 URL listed among GammaLoad indicators. |
| URL | hxxps[:]//sweet[.]csxvl00328[.]workers[.]dev/vehis | C2 URL used to deliver the second-stage VBScript loader. |
| URL | hxxps[:]//te[.]legra[.]ph/auuoyeipkudjgjnw-01-17 | Dead Drop Resolver URL listed among GammaLoad indicators. |
| URL | hxxps[:]//te[.]legra[.]ph/fxpppscdlw-12-27 | Dead Drop Resolver URL used to retrieve a C2 address. |
| URL | hxxps[:]//telegram[.]me/s/akatachi | Dead Drop Resolver URL used to retrieve a C2 address. |
| URL | hxxps[:]//telegram[.]me/s/oberfarir | Dead Drop Resolver URL used to retrieve a C2 address. |
| URL | hxxps[:]//www[.]telegram[.]me/s/bicotipus | Dead Drop Resolver URL listed among GammaLoad indicators. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes obfuscated VBScript and PowerShell loaders, including ROT13 and encoded payloads.T1053.005 · Scheduled TaskThe second stage creates a scheduled task that executes the payload stored in an Alternate Data Stream every 11 minutes.T1059.001 · PowerShellThe third stage launches PowerShell to retrieve, decrypt, and execute the final payload.T1082 · System Information DiscoveryThe first-stage loader collects the computer name and system-drive serial number to fingerprint the host.T1105 · Ingress Tool TransferThe loaders download subsequent VBScript and payload stages from C2 infrastructure.T1112 · Modify RegistryGammaLoad reads and updates C2 configuration values under HKCU\Console.T1140 · Deobfuscate/Decode Files or InformationThe loaders decode Base64 content and the third-stage PowerShell loader XOR-decrypts the retrieved payload.
People
Threat Actors
Malware
GammaLoadFSB’s matryoshka #2/3 - Gamaredon’s gifts that keeps unpacking - GammaLoadGammaPhishFSB’s matryoshka #1/3 - GammaPhish and GammaWormGammaSteelThe three stages ultimately fetch and run GammaSteel in memory, the stealer analysed in the final report of the series.GammaWipeGammaWipe (wiper)GammaWormFSB’s matryoshka #1/3 - GammaPhish and GammaWormPteranodonconventions. Over the past decade, their espionage arsenal has heavily evolved, shifting from the Pteranodon framework to highly modular, standalone payloads tracked under various names. To cut through this
Products
Microsoft WindowsThe chain caches its active C2 configuration in the Windows registry and falls back to Dead Drop Resolvers when needed.PowerShellThird Stage (PowerShell loader): Executed regularly by the scheduled task, this obfuscated loader spawns a hidden PowerShell process. It fetches, XOR-decrypts, and executes the payload in-memory.