General

  • Target

    4857383e05fb23de053b3cc1994d0fa203b823a68d155f87aa9f01697192c8b3

  • Size

    67KB

  • Sample

    240905-wpsaasxcpd

  • MD5

    e450307bfce7d0e4b0383511433ea249

  • SHA1

    efe1fa9e06b8dc51f90640a560fd2cc79a79cb30

  • SHA256

    4857383e05fb23de053b3cc1994d0fa203b823a68d155f87aa9f01697192c8b3

  • SHA512

    60d9874184f8a8cb71c013b92be289ca8b80b363ec0b77e7e946d1c5b3e11b672e55080dad69478ac87fb7a9639f14a5e9b6e44e93b9e2bb594eb76e1970be7a

  • SSDEEP

    1536:c4o3YVlrUwIat0swFuB+Oryjr/xQvVfvL+ckU9p0xC:cxxG0xy7e//xOVnL+cR9uC

Malware Config

Targets

    • Target

      120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41.exe

    • Size

      152KB

    • MD5

      1009eec443d9e621a5b3dc3b5680a1d8

    • SHA1

      51d0505457ad9a2d4acbc7c4385d72babd3b4806

    • SHA256

      120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41

    • SHA512

      f201dbdf9e6525d9ee0ecc2ee3416963518c0a853c7873052dd4d3e30baa895290ee0ce52e01cc91efaa1f5cd71e58cce5a287b490476ea0aa84efb45682e9dd

    • SSDEEP

      3072:mtWZqwoa9Xa1Idart19RdWQnyuuHn6LH1al3:mtxIqqdtQnyucn6LMd

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks