Overview

overview

10

Static

static

1

5dadaa8c3d...18.exe

windows7-x64

10

5dadaa8c3d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dadaa8c3d323e3bf0c0153ae1076c78_JaffaCakes118

  • Size

    35KB

  • Sample

    241019-vj22waxakf

  • MD5

    5dadaa8c3d323e3bf0c0153ae1076c78

  • SHA1

    a53a9f167b23010476d6f99cce7f51340081089f

  • SHA256

    c1d3e2f0d9944a5e1b36b6d6b7418d3296bf1a6ab5392d5e838f8e9f3a3ddb11

  • SHA512

    c17639dea20846922d63e55cc5f9319ed3b083d2eb7ac35f3963ebe6c93a25097622ce929c16d40aed0de5abf288ff78542f89f4ed0da9ac2352131c328200e7

  • SSDEEP

    384:BTynDLDDD/f9gO+0RT2ZkxmQxqrPEelZ7JcFgIVPmSnM4COuRa+RdrpWl/Ws:hQLDDLWQRT2mgEeP7JcaIVPZrwYM4/

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      5dadaa8c3d323e3bf0c0153ae1076c78_JaffaCakes118

    • Size

      35KB

    • MD5

      5dadaa8c3d323e3bf0c0153ae1076c78

    • SHA1

      a53a9f167b23010476d6f99cce7f51340081089f

    • SHA256

      c1d3e2f0d9944a5e1b36b6d6b7418d3296bf1a6ab5392d5e838f8e9f3a3ddb11

    • SHA512

      c17639dea20846922d63e55cc5f9319ed3b083d2eb7ac35f3963ebe6c93a25097622ce929c16d40aed0de5abf288ff78542f89f4ed0da9ac2352131c328200e7

    • SSDEEP

      384:BTynDLDDD/f9gO+0RT2ZkxmQxqrPEelZ7JcFgIVPmSnM4COuRa+RdrpWl/Ws:hQLDDLWQRT2mgEeP7JcaIVPZrwYM4/

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks