General

  • Target

    cae33d6a0788633ef6263601d9c5f303_JaffaCakes118

  • Size

    88KB

  • Sample

    241206-ed1nvsvjfm

  • MD5

    cae33d6a0788633ef6263601d9c5f303

  • SHA1

    184a50f039f7685b75ceb0fbab2b748483bf91cd

  • SHA256

    ae66cfbf795516ba8c7df1ae2386419df98a2da03fccb70f6cae260219ccc975

  • SHA512

    e7d8b998449d608bdba4448abaaa8e73bf011fc0e3f24c09579c1640b1ee03ab2ffc0e65395bb0784616181a619a60ee463c0d55aefa07a94b8196d31ea8ee47

  • SSDEEP

    1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yE8:6D0ctAVA/bmxIMnoKjyR/N8

Malware Config

Targets

    • Target

      cae33d6a0788633ef6263601d9c5f303_JaffaCakes118

    • Size

      88KB

    • MD5

      cae33d6a0788633ef6263601d9c5f303

    • SHA1

      184a50f039f7685b75ceb0fbab2b748483bf91cd

    • SHA256

      ae66cfbf795516ba8c7df1ae2386419df98a2da03fccb70f6cae260219ccc975

    • SHA512

      e7d8b998449d608bdba4448abaaa8e73bf011fc0e3f24c09579c1640b1ee03ab2ffc0e65395bb0784616181a619a60ee463c0d55aefa07a94b8196d31ea8ee47

    • SSDEEP

      1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yE8:6D0ctAVA/bmxIMnoKjyR/N8

    • Andromeda family

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks