Overview

overview

10

Static

static

3

3904c7479b...0N.exe

windows7-x64

10

3904c7479b...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10N

  • Size

    152KB

  • Sample

    241026-ae4dxstpem

  • MD5

    169ef5202f0fa2af2769a30ad97280f0

  • SHA1

    3c1a573b5911d4c2c59e0e9e4579d3a824df28a7

  • SHA256

    3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10

  • SHA512

    1e4fb08d7bca6cc31dbafa5347dd92ef24a8d58fc3063fe94691364a89157b9e01ed505774a52f0632036bc00342ade7f69cfcad2a23761ca459e1306de31631

  • SSDEEP

    1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+Anq5b30Md8SVD:2++TFnoWTTYBB1hHgN1AnqBd31uk

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10N

    • Size

      152KB

    • MD5

      169ef5202f0fa2af2769a30ad97280f0

    • SHA1

      3c1a573b5911d4c2c59e0e9e4579d3a824df28a7

    • SHA256

      3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10

    • SHA512

      1e4fb08d7bca6cc31dbafa5347dd92ef24a8d58fc3063fe94691364a89157b9e01ed505774a52f0632036bc00342ade7f69cfcad2a23761ca459e1306de31631

    • SSDEEP

      1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+Anq5b30Md8SVD:2++TFnoWTTYBB1hHgN1AnqBd31uk

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks