Overview

overview

10

Static

static

3

fcf6ef18e4...82.exe

windows7-x64

10

fcf6ef18e4...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcf6ef18e45949e66e79c580b7f92b9097c41dba3b2976f3235b2f93c7f95082.exe

  • Size

    155KB

  • Sample

    241202-m1636a1ng1

  • MD5

    ad08082dbb3d86552b9432ccb0b4ae90

  • SHA1

    52af7c1185b6ff693df2518546731cfb6b1bfce8

  • SHA256

    fcf6ef18e45949e66e79c580b7f92b9097c41dba3b2976f3235b2f93c7f95082

  • SHA512

    3c7a820c47e45a49b8910550285c2a8b1735f6a584470578d1d4205cc525dc654d539cd00f59f496d097c9102f91efa1e2963711144c440b90b3dbc8771e2ae1

  • SSDEEP

    1536:mvy50tV44aqwoa9ujdbNyVXa1lgNdaOCt1kTWoLY/r4T8YorEkyrnrm0URuj:mtWZqwoa9Xa1Idart19E

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      fcf6ef18e45949e66e79c580b7f92b9097c41dba3b2976f3235b2f93c7f95082.exe

    • Size

      155KB

    • MD5

      ad08082dbb3d86552b9432ccb0b4ae90

    • SHA1

      52af7c1185b6ff693df2518546731cfb6b1bfce8

    • SHA256

      fcf6ef18e45949e66e79c580b7f92b9097c41dba3b2976f3235b2f93c7f95082

    • SHA512

      3c7a820c47e45a49b8910550285c2a8b1735f6a584470578d1d4205cc525dc654d539cd00f59f496d097c9102f91efa1e2963711144c440b90b3dbc8771e2ae1

    • SSDEEP

      1536:mvy50tV44aqwoa9ujdbNyVXa1lgNdaOCt1kTWoLY/r4T8YorEkyrnrm0URuj:mtWZqwoa9Xa1Idart19E

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks