Overview

overview

10

Static

static

3

5c2c38b0fb...18.exe

windows7-x64

10

5c2c38b0fb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c2c38b0fb9530a2db98cee9b5808592_JaffaCakes118

  • Size

    44KB

  • Sample

    241019-mf1qms1elb

  • MD5

    5c2c38b0fb9530a2db98cee9b5808592

  • SHA1

    0ff2f893f6eb589d1475bb047f47f9fef2ad6d30

  • SHA256

    2e1f505444d3dc4995e9beebcfb5b5cf3e9ba14d91e3b7425bb9d39db087f84d

  • SHA512

    3b692e5997671ba68b0b6fc1a6b7a517825893289813c96fb649818bcfaf14cc79ebd7c648c43565bdb982ab38fde07b312620f22671d1cb1d844e1773d5d3bd

  • SSDEEP

    768:yUUHredWiMB8EvCwSUu5SxJtp680JQS4zt:ve+keVwSUusJtqJQ

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      5c2c38b0fb9530a2db98cee9b5808592_JaffaCakes118

    • Size

      44KB

    • MD5

      5c2c38b0fb9530a2db98cee9b5808592

    • SHA1

      0ff2f893f6eb589d1475bb047f47f9fef2ad6d30

    • SHA256

      2e1f505444d3dc4995e9beebcfb5b5cf3e9ba14d91e3b7425bb9d39db087f84d

    • SHA512

      3b692e5997671ba68b0b6fc1a6b7a517825893289813c96fb649818bcfaf14cc79ebd7c648c43565bdb982ab38fde07b312620f22671d1cb1d844e1773d5d3bd

    • SSDEEP

      768:yUUHredWiMB8EvCwSUu5SxJtp680JQS4zt:ve+keVwSUusJtqJQ

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks