Overview

overview

10

Static

static

1

a7c76be7c9...18.exe

windows7-x64

10

a7c76be7c9...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a7c76be7c92a4d66c59670925151ac3b_JaffaCakes118

  • Size

    59KB

  • Sample

    240818-xa3m6a1ekn

  • MD5

    a7c76be7c92a4d66c59670925151ac3b

  • SHA1

    d419ddeedd0c7f5ee97b42505e58d4f1c3b564f0

  • SHA256

    5e3fc3991151d632a4a6325879ab7027744f956ea8dba4dc12250271105f4cef

  • SHA512

    e7d97539fff42ca608df15d8a8623411360e553bc1fad4d4a968db58fb4417912bf2282b2fb6832322fd822bc94fc00b9a96053bfec6ba52d8ebd89bcc5f8ed5

  • SSDEEP

    1536:PKW5c12VUZdmxX02wIx27SbHm/lHm/1Hm/BHm/hevwZn:PKWtVUXmPx27Gm/Vm/lm/Zm/hevwh

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      a7c76be7c92a4d66c59670925151ac3b_JaffaCakes118

    • Size

      59KB

    • MD5

      a7c76be7c92a4d66c59670925151ac3b

    • SHA1

      d419ddeedd0c7f5ee97b42505e58d4f1c3b564f0

    • SHA256

      5e3fc3991151d632a4a6325879ab7027744f956ea8dba4dc12250271105f4cef

    • SHA512

      e7d97539fff42ca608df15d8a8623411360e553bc1fad4d4a968db58fb4417912bf2282b2fb6832322fd822bc94fc00b9a96053bfec6ba52d8ebd89bcc5f8ed5

    • SSDEEP

      1536:PKW5c12VUZdmxX02wIx27SbHm/lHm/1Hm/BHm/hevwZn:PKWtVUXmPx27Gm/Vm/lm/Zm/hevwh

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks