ANDROMEDA

Andromeda is a type of malware, or malicious software, designed to exploit and damage computer systems. It can infiltrate systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. Andromeda has been involved in spreading another malware called Dridex at different stages of its lifecycle, alongside other botnets such as Necurs and Cutwail. In addition, it appears that Tomiris may have hijacked extinct Andromeda hostnames or domains. In our research, we analyzed the registration information of the command and control domains used by ProjectM for the Andromeda, Crimson, and Peppy Trojans. The Andromeda samples utilized these undisguised domains to deliver Peppy Trojans that used the previously observed ProjectM domain “bbmdroid.com” as a C2 server. However, it was found that malware authors also tested Andromeda in a virtual environment, implementing a check that allowed users to bypass the VM detection. The Andromeda malware has also been linked with the Slave malware; an infected machine with Andromeda is required first to download the Slave malware. These two are distinct strains of malware and do not communicate with each other. Andromeda is typically distributed via email messages disguised as outstanding invoices. Furthermore, this year, Turla, a Russian-speaking Advanced Persistent Threat (APT) group, was seen using command-and-control servers from the decade-old Andromeda malware to target and spy on Ukrainian systems.