Static task
static1
Behavioral task
behavioral1
Sample
Andromeda v2.06.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Andromeda Builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Anti vmware/start_me_on_vm_before.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
Panel/plugins/socks4/index.ps1
Resource
win10v2004-20230220-en
General
-
Target
Andromeda v2.06.rar
-
Size
2.8MB
-
MD5
4ac6d9cbf29c6000d5eb9f2845f7048a
-
SHA1
12f73a6897bb79d17dbf1615254e96bb0b5fad00
-
SHA256
0cf3e8db566d34f19d7c2df598f038542439d1f48e4b228d04c0a5469a62290b
-
SHA512
1c70aed02b0d107c93d99b0d03733133d47ecefb310f54996be19b9f91c62725f9eb41951c0a4a26c09f30235ee0752324eac5519fae7c44cba4c1fad9832eda
-
SSDEEP
49152:1nLD6q6AM/sBzTmNX7FvoZZ//STJHD8udOgWjswIcONO4F6zUgwKN2Bq0gc5/+Z+:R6q6AM+iX79oL//STFDOF4w4UUS7c5y+
Malware Config
Signatures
Files
-
Andromeda v2.06.rar.rar
-
.DS_Store
-
Andromeda Builder.exe.exe windows x86
4abc70319c1f8cc5c8e5aabaa495e853
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
UpdateWindow
ShowWindow
SetWindowRgn
SetWindowLongA
SetLayeredWindowAttributes
SetDlgItemTextA
SetCursor
SendMessageA
MessageBoxA
LoadIconA
LoadCursorA
LoadBitmapA
GetWindowLongA
GetDlgItemTextA
GetDlgItem
EndDialog
DialogBoxParamA
CallWindowProcA
kernel32
FindResourceA
GetModuleHandleA
lstrlenA
WriteFile
UnmapViewOfFile
Sleep
SizeofResource
RtlZeroMemory
RtlMoveMemory
MapViewOfFile
LockResource
CloseHandle
CreateFileA
CreateFileMappingA
ExitProcess
FlushViewOfFile
LoadResource
comdlg32
GetSaveFileNameA
comctl32
InitCommonControlsEx
gdi32
CreatePatternBrush
ExtCreateRegion
shell32
ShellExecuteA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
advapi32
RegQueryValueExA
Sections
.text Size: 332KB - Virtual size: 332KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 992KB - Virtual size: 992KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Anti vmware/start_me_on_vm_before.exe.exe windows x86
5345c415b7874504827119f98f2bfdfd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
ExitProcess
GetLastError
GetStdHandle
WaitForSingleObject
WriteConsoleA
CreateEventA
Sections
.text Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Panel/GeoIPCountryWhois.csv.gz.gz
-
Panel/back.css
-
Panel/config.php
-
Panel/fg.php
-
Panel/fg_logs/.htaccess
-
Panel/fg_logs/index.php
-
Panel/geo.gif
-
Panel/ifg.php
-
Panel/image.php
-
Panel/index.php
-
Panel/plugins/.htaccess
-
Panel/plugins/fg/index.php
-
Panel/plugins/fg/link.php
-
Panel/plugins/index.php
-
Panel/plugins/socks4/gate.php
-
Panel/plugins/socks4/index.php.ps1
-
Panel/plugins/socks4/link.php
-
Panel/style.css
-
Plugins/f.pack
-
Plugins/r.pack
-
Plugins/s.pack