Overview

overview

10

Static

static

3

87d98c5525...18.exe

windows7-x64

10

87d98c5525...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87d98c5525dcbf19461ac9c584a7d01f_JaffaCakes118

  • Size

    13KB

  • Sample

    240810-1y4f5svbma

  • MD5

    87d98c5525dcbf19461ac9c584a7d01f

  • SHA1

    0beeb8740369834a744826ff19e03604c82d0900

  • SHA256

    8121387c8884eb7021064f4c0c21d568d77a6f5aed52894c20ff2c84ab359845

  • SHA512

    ec236a473c20626aa8641a6ef7ef7337ff4a091ef7bf4a3494d449ff082feea3cf9e580a8d123c2e2568e821b38e5123ece7519d1fdb9ea826f9f1d8886d0747

  • SSDEEP

    384:GLOTSoMaHAhzQYVu1TY7gKJEmizmzCaF1FY:DSagh0Qu1UkKE7AF

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      87d98c5525dcbf19461ac9c584a7d01f_JaffaCakes118

    • Size

      13KB

    • MD5

      87d98c5525dcbf19461ac9c584a7d01f

    • SHA1

      0beeb8740369834a744826ff19e03604c82d0900

    • SHA256

      8121387c8884eb7021064f4c0c21d568d77a6f5aed52894c20ff2c84ab359845

    • SHA512

      ec236a473c20626aa8641a6ef7ef7337ff4a091ef7bf4a3494d449ff082feea3cf9e580a8d123c2e2568e821b38e5123ece7519d1fdb9ea826f9f1d8886d0747

    • SSDEEP

      384:GLOTSoMaHAhzQYVu1TY7gKJEmizmzCaF1FY:DSagh0Qu1UkKE7AF

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks