Overview

overview

10

Static

static

3

a02b961480...18.exe

windows7-x64

10

a02b961480...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118

  • Size

    252KB

  • Sample

    241126-gjve5stqck

  • MD5

    a02b961480e8b7fc9313c6e2ae480442

  • SHA1

    fa6243f289015a1a78a5fd28f3eba56d07c33f6b

  • SHA256

    be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120

  • SHA512

    c721a7eb719be9b57716f9ab739a65cf89bf88db2681964017a41c84fc734954b1d87b30881631f355f82c2dab1dff3d209d078e490960dc0e1691c6d1505792

  • SSDEEP

    6144:b1Wj/JCXHjMc5qKeMuFFKN0jb2ZlhdBJVjY/eRUExoJyOYHB7qY8zIK0GznuAXyk:pWj

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118

    • Size

      252KB

    • MD5

      a02b961480e8b7fc9313c6e2ae480442

    • SHA1

      fa6243f289015a1a78a5fd28f3eba56d07c33f6b

    • SHA256

      be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120

    • SHA512

      c721a7eb719be9b57716f9ab739a65cf89bf88db2681964017a41c84fc734954b1d87b30881631f355f82c2dab1dff3d209d078e490960dc0e1691c6d1505792

    • SSDEEP

      6144:b1Wj/JCXHjMc5qKeMuFFKN0jb2ZlhdBJVjY/eRUExoJyOYHB7qY8zIK0GznuAXyk:pWj

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks