Overview

overview

10

Static

static

1

7ab06baa6b...18.exe

windows7-x64

10

7ab06baa6b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ab06baa6b456778b2202d793127efb5_JaffaCakes118

  • Size

    39KB

  • Sample

    241028-y3xs2swgkm

  • MD5

    7ab06baa6b456778b2202d793127efb5

  • SHA1

    910993d52f7021bafef72f3425c08dc329d37e92

  • SHA256

    b59cece90cc2579a4a4592acfb0444999675c95eed0e4c48c4a769e122f69fd3

  • SHA512

    9e15b93c1d62bd1eeff54626ce864fb1ededfde24746393d40e63ed0d5d031b9c20f625b68d54f38fb788b3fc9bdbdb8c470735da4001c68acc9412641d38469

  • SSDEEP

    384:GNOaOwImAFEC9r/H04lnTXZUikSnm/UHNeCcTtZ6cd1wcafq9npC4COuRa+Rdrp2:rwkFR9rv08TZU6NeCu1q4LwYM47

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      7ab06baa6b456778b2202d793127efb5_JaffaCakes118

    • Size

      39KB

    • MD5

      7ab06baa6b456778b2202d793127efb5

    • SHA1

      910993d52f7021bafef72f3425c08dc329d37e92

    • SHA256

      b59cece90cc2579a4a4592acfb0444999675c95eed0e4c48c4a769e122f69fd3

    • SHA512

      9e15b93c1d62bd1eeff54626ce864fb1ededfde24746393d40e63ed0d5d031b9c20f625b68d54f38fb788b3fc9bdbdb8c470735da4001c68acc9412641d38469

    • SSDEEP

      384:GNOaOwImAFEC9r/H04lnTXZUikSnm/UHNeCcTtZ6cd1wcafq9npC4COuRa+Rdrp2:rwkFR9rv08TZU6NeCu1q4LwYM47

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks