GURU SPIDER

Also known as: GURU SPIDER, Guru Spider

Early in 2018, CrowdStrike Intelligence observed GURU SPIDER supporting the distribution of multiple crimeware families through its flagship malware loader, Quant Loader.

🌍 Country ["Russia"]

Associated Operations

2016 a new trojan downloader became available to purchase on various Russian underground forums. Named 'Quant Loader' by its creator 2016-09 2018-03 Banking Trojans Barracuda Threat Spotlight: New URL File Outbreak Could be a Ransomware Attempt On September 1 QuantLoader is a Trojan downloader that has been available for sale on underground forums for quite some time now. It has been used in campaigns serving a range of malware and Pony (aka Fareit) malware families. and RATs. The campaign that we are going to analyze is serving a BackDoor. https://blog.barracuda.com/2018/04/10/barracuda-threat-spotlight-new-url-file-outbreak-could-be-a-ransomware-attempt/ https://blog.malwarebytes.com/threat-analysis/2018/03/an-in-depth-malware-analysis-of-quantloader/ https://www.forcepoint.com/blog/x-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground including ransomware the downloader has already been used to distribute the Locky Zepto crypto-ransomware

Introduction

Early in 2018, CrowdStrike Intelligence observed GURU SPIDER supporting the distribution of multiple crimeware families through its flagship malware loader, Quant Loader.

Activities and Tactics

Country of Origin: 🇷🇺 [“Russia”]

Notable Campaigns

  • 2016 a new trojan downloader became available to purchase on various Russian underground forums. Named ‘Quant Loader’ by its creator
  • 2016-09
  • 2018-03
  • Banking Trojans
  • Barracuda Threat Spotlight: New URL File Outbreak Could be a Ransomware Attempt
  • On September 1
  • QuantLoader is a Trojan downloader that has been available for sale on underground forums for quite some time now. It has been used in campaigns serving a range of malware
  • and Pony (aka Fareit) malware families.
  • and RATs. The campaign that we are going to analyze is serving a BackDoor.
  • https://blog.barracuda.com/2018/04/10/barracuda-threat-spotlight-new-url-file-outbreak-could-be-a-ransomware-attempt/
  • https://blog.malwarebytes.com/threat-analysis/2018/03/an-in-depth-malware-analysis-of-quantloader/
  • https://www.forcepoint.com/blog/x-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground
  • including ransomware
  • the downloader has already been used to distribute the Locky Zepto crypto-ransomware

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • MBS BTC Stealer:
  • MKL Pro Keylogger:
  • Madness PRO DDoS:
  • Quant Loader:
  • Z*Stealer:

Attribution and Evidence

Country of Origin: [“Russia”] Additional attribution information pending cataloguing.

References

References pending cataloguing.