Overview

overview

10

Static

static

3

d707f29ae5...18.exe

windows7-x64

10

d707f29ae5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d707f29ae595f3d596417a5d3ec8a79d_JaffaCakes118

  • Size

    100KB

  • Sample

    240909-y3xhaazekd

  • MD5

    d707f29ae595f3d596417a5d3ec8a79d

  • SHA1

    03ac933d183eadec359860df98c95f40cf144477

  • SHA256

    f50f8f34ae1bbff9e8a25972a7e2268e4b02fcfff8cecf4c60d729cb41513553

  • SHA512

    0ea6a15c1a075695f38619d424ba721332cdfcd9ecdfa2c089337571e5faa0c8544bd65f71ade923a1c4347f8b09f0aaca094938122f5145aeae3654cb22912d

  • SSDEEP

    1536:ltsQYRi9Kw0gqAKrYrL8tikOjm8HfML1MuvkB4RND/a3JkybmBKGlaD6O:lmQ5QwXqtYrL8UkX2uvEaD/a5kybqYD

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      d707f29ae595f3d596417a5d3ec8a79d_JaffaCakes118

    • Size

      100KB

    • MD5

      d707f29ae595f3d596417a5d3ec8a79d

    • SHA1

      03ac933d183eadec359860df98c95f40cf144477

    • SHA256

      f50f8f34ae1bbff9e8a25972a7e2268e4b02fcfff8cecf4c60d729cb41513553

    • SHA512

      0ea6a15c1a075695f38619d424ba721332cdfcd9ecdfa2c089337571e5faa0c8544bd65f71ade923a1c4347f8b09f0aaca094938122f5145aeae3654cb22912d

    • SSDEEP

      1536:ltsQYRi9Kw0gqAKrYrL8tikOjm8HfML1MuvkB4RND/a3JkybmBKGlaD6O:lmQ5QwXqtYrL8UkX2uvEaD/a5kybqYD

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks