Overview

overview

10

Static

static

3

ae455f6dba...18.exe

windows7-x64

10

ae455f6dba...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae455f6dbafbe31288273839594287c4_JaffaCakes118

  • Size

    107KB

  • Sample

    241129-cpw4psyraz

  • MD5

    ae455f6dbafbe31288273839594287c4

  • SHA1

    8c6f7140fac14bd262e4befe5e4fe5dd73f05954

  • SHA256

    b5c295071d4c2b25b920beadd01f74c19e80c90b230fb8a53f9de11ae24c79b0

  • SHA512

    43dbeb3aa922c20c351757659609edf68b5a90cc6d99f96e9c85ecdb3cc7e2309cc368d79e0ebbd9384ce8246fe2a94225437a59dbdb853be417a2e4033e9dc0

  • SSDEEP

    3072:Rw31FyVLEJKyGbn06udaNCDyoMnzD1xyrniNW/Te9i:Rs3X+n06uVDFJb9/

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      ae455f6dbafbe31288273839594287c4_JaffaCakes118

    • Size

      107KB

    • MD5

      ae455f6dbafbe31288273839594287c4

    • SHA1

      8c6f7140fac14bd262e4befe5e4fe5dd73f05954

    • SHA256

      b5c295071d4c2b25b920beadd01f74c19e80c90b230fb8a53f9de11ae24c79b0

    • SHA512

      43dbeb3aa922c20c351757659609edf68b5a90cc6d99f96e9c85ecdb3cc7e2309cc368d79e0ebbd9384ce8246fe2a94225437a59dbdb853be417a2e4033e9dc0

    • SSDEEP

      3072:Rw31FyVLEJKyGbn06udaNCDyoMnzD1xyrniNW/Te9i:Rs3X+n06uVDFJb9/

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks