Overview

overview

10

Static

static

3

b06aeb00fd...18.exe

windows7-x64

10

b06aeb00fd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b06aeb00fd6345e61776ce1cfeeac103_JaffaCakes118

  • Size

    40KB

  • Sample

    241129-lsa53stncq

  • MD5

    b06aeb00fd6345e61776ce1cfeeac103

  • SHA1

    e3cf88d370c28e02c70ed1105c7aa5d4217537a5

  • SHA256

    86ed0a3a06f872ca5c54da8a6fca20f7f41f726793a0f586f3ac7663e02bc9f1

  • SHA512

    57ea0d9844299a86b9891779eea8ceb7fa5a9b18d4a802f79f0869f2b420ece04d8a5ac530d760f8d22de4080f9383970006f7ca5293a9da226dd60726a03b45

  • SSDEEP

    768:MXvvcXtkh40BxOkLcV2cjmtMjr3U0CuHQ0:MX3cXtSBxdLcutSr3wE

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      b06aeb00fd6345e61776ce1cfeeac103_JaffaCakes118

    • Size

      40KB

    • MD5

      b06aeb00fd6345e61776ce1cfeeac103

    • SHA1

      e3cf88d370c28e02c70ed1105c7aa5d4217537a5

    • SHA256

      86ed0a3a06f872ca5c54da8a6fca20f7f41f726793a0f586f3ac7663e02bc9f1

    • SHA512

      57ea0d9844299a86b9891779eea8ceb7fa5a9b18d4a802f79f0869f2b420ece04d8a5ac530d760f8d22de4080f9383970006f7ca5293a9da226dd60726a03b45

    • SSDEEP

      768:MXvvcXtkh40BxOkLcV2cjmtMjr3U0CuHQ0:MX3cXtSBxdLcutSr3wE

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks