Overview

overview

10

Static

static

1

2e45f2e4a3...18.exe

windows7-x64

10

2e45f2e4a3...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e45f2e4a3f347b8e3fe0a35e8e16ed4_JaffaCakes118

  • Size

    141KB

  • Sample

    241009-kvmffswaka

  • MD5

    2e45f2e4a3f347b8e3fe0a35e8e16ed4

  • SHA1

    95d954d1c9f785f14daddc5784bb5707be294e3f

  • SHA256

    a6e898960d88ad88bc52bb21f243223af9dc8f6dade425fcf6c771f9c24d2a8d

  • SHA512

    f6f0fde7c2f6ddf7dfa2e6d9b76a1b931cd405c9acf991416c9366aad1eb6dba13c416b4b48a55cb0aefe213b41613646b832402c5c9d5fa7bef3f34b60018b1

  • SSDEEP

    3072:CaS9oD8OSDLOEZJywsGcE5XFGy6Z7+ZF/4I2zP6b79E7Fo2:CaS2D9lt

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      2e45f2e4a3f347b8e3fe0a35e8e16ed4_JaffaCakes118

    • Size

      141KB

    • MD5

      2e45f2e4a3f347b8e3fe0a35e8e16ed4

    • SHA1

      95d954d1c9f785f14daddc5784bb5707be294e3f

    • SHA256

      a6e898960d88ad88bc52bb21f243223af9dc8f6dade425fcf6c771f9c24d2a8d

    • SHA512

      f6f0fde7c2f6ddf7dfa2e6d9b76a1b931cd405c9acf991416c9366aad1eb6dba13c416b4b48a55cb0aefe213b41613646b832402c5c9d5fa7bef3f34b60018b1

    • SSDEEP

      3072:CaS9oD8OSDLOEZJywsGcE5XFGy6Z7+ZF/4I2zP6b79E7Fo2:CaS2D9lt

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks