Overview

overview

10

Static

static

3

c58e88a5d0...2N.exe

windows7-x64

10

c58e88a5d0...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c58e88a5d0f0783f9c64db72aca03b7c1355aa9d210a888bcd0f351c94f695e2N.exe

  • Size

    155KB

  • Sample

    241203-v1chjsvqet

  • MD5

    d968ebeaba834057ca30a7747b4c11f0

  • SHA1

    5d0d1d5d1093a2adc0b289ada7900dfa5951701a

  • SHA256

    c58e88a5d0f0783f9c64db72aca03b7c1355aa9d210a888bcd0f351c94f695e2

  • SHA512

    b9e3ae640aad6325a80c629bf2ac195e336ff599d5b5ce9b71b7f1461b353a22ed767d794fef2edad768cd7e236c53b54753e30856a8358a641d3bdbd4734c09

  • SSDEEP

    1536:mvy50tV44aqwoa9ujdbNyVXa1lgNdaOCt1kTWoLY/r4T8YorEkyrnrm0URup:mtWZqwoa9Xa1Idart19c

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      c58e88a5d0f0783f9c64db72aca03b7c1355aa9d210a888bcd0f351c94f695e2N.exe

    • Size

      155KB

    • MD5

      d968ebeaba834057ca30a7747b4c11f0

    • SHA1

      5d0d1d5d1093a2adc0b289ada7900dfa5951701a

    • SHA256

      c58e88a5d0f0783f9c64db72aca03b7c1355aa9d210a888bcd0f351c94f695e2

    • SHA512

      b9e3ae640aad6325a80c629bf2ac195e336ff599d5b5ce9b71b7f1461b353a22ed767d794fef2edad768cd7e236c53b54753e30856a8358a641d3bdbd4734c09

    • SSDEEP

      1536:mvy50tV44aqwoa9ujdbNyVXa1lgNdaOCt1kTWoLY/r4T8YorEkyrnrm0URup:mtWZqwoa9Xa1Idart19c

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks