Overview

overview

10

Static

static

5

2edd6de8c7...18.exe

windows7-x64

10

2edd6de8c7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2edd6de8c75ce690be653d3596974245_JaffaCakes118

  • Size

    317KB

  • Sample

    241009-lnxhhsvhmm

  • MD5

    2edd6de8c75ce690be653d3596974245

  • SHA1

    0c86b5d46dafe4e222b71aad08fa83ca2c513d44

  • SHA256

    e32d21c2d6cea86a63ae6cb20f1d6b4ac6ec8ea534104d1b11b995970a017c45

  • SHA512

    4d8b19f92ef8e5cd3c2fc23c9557583fc58ac8e60435460467b708c3cef2d3d01615ce7fbe9aeeeb53378fb1682a4e6777f6840e58d6eafa13c9c58f240c0b7a

  • SSDEEP

    6144:9DBSP9c0wEjnb1QP4A8bKkfjLd8wTmbppIxIInDMPzOK403Qf:9NSPB1PDbKk7Lq4mbInwPzOXf

Score
10/10
andromedabackdoorbotnetdiscoverypersistenceupx

Malware Config

Targets

    • Target

      2edd6de8c75ce690be653d3596974245_JaffaCakes118

    • Size

      317KB

    • MD5

      2edd6de8c75ce690be653d3596974245

    • SHA1

      0c86b5d46dafe4e222b71aad08fa83ca2c513d44

    • SHA256

      e32d21c2d6cea86a63ae6cb20f1d6b4ac6ec8ea534104d1b11b995970a017c45

    • SHA512

      4d8b19f92ef8e5cd3c2fc23c9557583fc58ac8e60435460467b708c3cef2d3d01615ce7fbe9aeeeb53378fb1682a4e6777f6840e58d6eafa13c9c58f240c0b7a

    • SSDEEP

      6144:9DBSP9c0wEjnb1QP4A8bKkfjLd8wTmbppIxIInDMPzOK403Qf:9NSPB1PDbKk7Lq4mbInwPzOXf

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistenceupx

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks