andromeda | 3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10 | Triage

Submit
Reports

Overview

overview

Static

static

3

3904c7479b...0N.exe

windows7-x64

3904c7479b...0N.exe

windows10-2004-x64

Sharing

General

Target

3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10N
Size

152KB
Sample

241026-ah1gfawhkg
MD5

169ef5202f0fa2af2769a30ad97280f0
SHA1

3c1a573b5911d4c2c59e0e9e4579d3a824df28a7
SHA256

3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10
SHA512

1e4fb08d7bca6cc31dbafa5347dd92ef24a8d58fc3063fe94691364a89157b9e01ed505774a52f0632036bc00342ade7f69cfcad2a23761ca459e1306de31631
SSDEEP

1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+Anq5b30Md8SVD:2++TFnoWTTYBB1hHgN1AnqBd31uk

Score

10^/10

andromeda backdoor botnet discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10N.exe

Resource

win7-20240903-en

andromeda backdoor botnet discovery

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10N.exe

Resource

win10v2004-20241007-en

andromeda backdoor botnet discovery persistence

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10N
- Size
  
  152KB
- MD5
  
  169ef5202f0fa2af2769a30ad97280f0
- SHA1
  
  3c1a573b5911d4c2c59e0e9e4579d3a824df28a7
- SHA256
  
  3904c7479b8cb7f73423973cb793d3ed321ed02d5a4b60ec7a7dc8e89213fc10
- SHA512
  
  1e4fb08d7bca6cc31dbafa5347dd92ef24a8d58fc3063fe94691364a89157b9e01ed505774a52f0632036bc00342ade7f69cfcad2a23761ca459e1306de31631
- SSDEEP
  
  1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+Anq5b30Md8SVD:2++TFnoWTTYBB1hHgN1AnqBd31uk
Score

10^/10

andromeda backdoor botnet discovery persistence
- Andromeda family
  andromeda
- Andromeda, Gamarue
  Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
  botnet backdoor andromeda
- Detects Andromeda payload.
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

andromedabackdoorbotnetdiscovery

behavioral2

andromedabackdoorbotnetdiscoverypersistence

© 2018-2025

Terms | Privacy