General

  • Target

    0c67f9c42b1ce79e7ff973873d34d2e6f131ea265840ea69f6428aeebea6d670.exe

  • Size

    62KB

  • Sample

    241127-hqjsnayrfk

  • MD5

    3a00be7fa8ad9bec9df3ec212d72a30d

  • SHA1

    32d607664e83cb759fbdf5aba032b43ab7f45724

  • SHA256

    0c67f9c42b1ce79e7ff973873d34d2e6f131ea265840ea69f6428aeebea6d670

  • SHA512

    772f10b14c97e380640ab5bd1f611b72192e0eb765c6d7d71d796279d9b1eb26d6345a2e680c7a02baad5b927bae525b20b3b9c2f95e79511fa051e07a5c027b

  • SSDEEP

    768:8ZYOGJ8z39m6odrD2ydQtaCGvRDvqguFjI3LOLisuIPcH9e3FEx8EFK4AVSi0WCu:83t2dGanvsh2ki4PQeVEKE38TCNMBMpG

Malware Config

Targets

    • Target

      0c67f9c42b1ce79e7ff973873d34d2e6f131ea265840ea69f6428aeebea6d670.exe

    • Size

      62KB

    • MD5

      3a00be7fa8ad9bec9df3ec212d72a30d

    • SHA1

      32d607664e83cb759fbdf5aba032b43ab7f45724

    • SHA256

      0c67f9c42b1ce79e7ff973873d34d2e6f131ea265840ea69f6428aeebea6d670

    • SHA512

      772f10b14c97e380640ab5bd1f611b72192e0eb765c6d7d71d796279d9b1eb26d6345a2e680c7a02baad5b927bae525b20b3b9c2f95e79511fa051e07a5c027b

    • SSDEEP

      768:8ZYOGJ8z39m6odrD2ydQtaCGvRDvqguFjI3LOLisuIPcH9e3FEx8EFK4AVSi0WCu:83t2dGanvsh2ki4PQeVEKE38TCNMBMpG

    • Andromeda family

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks