TA505 APT Hackers using New AndroMut Malware to Drop FlawedAmmyy RAT and Gain Remote Access

Researchers uncovered a new malware dropper called AndroMut from one of the infamous APT group TA505 to drop the FlawedAmmyy Remote Access Trojan gain the remote access from the infected victim’s computer.

TA505 hacking group believed to reside in Russia and the threat actors from this group involved in various high profile cyber attacks including infamous Dridex, Locky ransomware, ServHelper malware, FlawedAmmyy, delivered through malicious email campaigns.

FlawedAmmyy is a full-featured RAT that was first observed in early 2016,  since then it was used by various cybercrime groups to attack thousands of victims around the world.

This campaign that observed by Proofpoint researchers through a spam email campaign that delivered Word or Excel file used macros to execute a Msiexec command.

Once the command is executed, Macro download and execute either the FlawedAmmyy loader or AndroMut. 

Another campaign targeted recipients at financial institutions in Singapore, UAE, and the USA.

According to Proofpoint researchers, “AndroMut is a new downloader malware written in C++ that Proofpoint researchers began observing in the wild in June 2019. The “Andro” part of the name comes from some of the pieces which bear resemblance to another downloader malware known as Andromeda [1] and “Mut” is based off a mutex that the analyzed sample creates: “mutshellmy777”.”

Based on the malware observation, it resolves most of the Windows API calls at run time by hash and it using two ways to decrypt the strings.

In this case, The encrypted string is base64-decoded then decrypted with AES-256 in ECB mode.

Also, AndroMut using various anti-analysis technique and persistence technique to evade detection and make the analysis process hard to experts.

Researchers also observed some low-confidence overlaps between it and two other malware downloaders: Andromeda and QtLoader.

“Proofpoint researchers have observed TA505 and a number of other actors focus on downloaders, RATs, information stealers, and banking Trojans.  The new AndroMut downloader, when combined with the FlawedAmmy RAT as its payload appears to be TA505’s new pet for the summer of 2019.”

Indicators of Compromise (IOCs)