General

  • Target

    96fde4dc165f7e98d75676f2869a6f67_JaffaCakes118

  • Size

    13KB

  • Sample

    240814-v1798athnb

  • MD5

    96fde4dc165f7e98d75676f2869a6f67

  • SHA1

    6dac7d4db134c9ac7a7dda578e981a00e332d9f9

  • SHA256

    1e07bf8ee2478c49e9f02f161b5b0815cfc8828b7acafb7007be1cc2668de7fa

  • SHA512

    9fb98b853321f69ad26f613d82224729baf7c9fa5dcc216170f3b40ec50bcb8482cad36a63a710b76263f31837356719b50eba4e0cc726c93d8c1ba8e142b062

  • SSDEEP

    192:+yEh4bJlnNdEIv1J/b9i7s4pwrARgZd1SrMksXgUdBOvAUPuDtwFWx3f/:j04Vfdj9JT9uxRgZGz0glhPuDWWx3f

Malware Config

Targets

    • Target

      96fde4dc165f7e98d75676f2869a6f67_JaffaCakes118

    • Size

      13KB

    • MD5

      96fde4dc165f7e98d75676f2869a6f67

    • SHA1

      6dac7d4db134c9ac7a7dda578e981a00e332d9f9

    • SHA256

      1e07bf8ee2478c49e9f02f161b5b0815cfc8828b7acafb7007be1cc2668de7fa

    • SHA512

      9fb98b853321f69ad26f613d82224729baf7c9fa5dcc216170f3b40ec50bcb8482cad36a63a710b76263f31837356719b50eba4e0cc726c93d8c1ba8e142b062

    • SSDEEP

      192:+yEh4bJlnNdEIv1J/b9i7s4pwrARgZd1SrMksXgUdBOvAUPuDtwFWx3f/:j04Vfdj9JT9uxRgZGz0glhPuDWWx3f

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks