General

  • Target

    d04878ff177c4553283d0656d9aae777_JaffaCakes118

  • Size

    34KB

  • Sample

    241207-c8ptqs1qhv

  • MD5

    d04878ff177c4553283d0656d9aae777

  • SHA1

    4aecf55d08796bd86fd6244e066eb6078dbf1e20

  • SHA256

    6185ca3f0c3799e7ae9ccf987b6a58199edf13d2b5a38c21c52882c2a29f287c

  • SHA512

    6ad274409ea451b72a6e9b73f3ef082943ec91573fcd3d38443d42c572d416f1c811c11faa5a052ef6d61a7658a69107d7cb3c54d602404b37917510b0054c23

  • SSDEEP

    384:jmF/v4fhSQfOwAPnACI1VoP/aJuzgSk2C8RlWWVKlGzMNNGd2h0omd:jS/GLlAvIVoHFg6nKevd

Malware Config

Targets

    • Target

      d04878ff177c4553283d0656d9aae777_JaffaCakes118

    • Size

      34KB

    • MD5

      d04878ff177c4553283d0656d9aae777

    • SHA1

      4aecf55d08796bd86fd6244e066eb6078dbf1e20

    • SHA256

      6185ca3f0c3799e7ae9ccf987b6a58199edf13d2b5a38c21c52882c2a29f287c

    • SHA512

      6ad274409ea451b72a6e9b73f3ef082943ec91573fcd3d38443d42c572d416f1c811c11faa5a052ef6d61a7658a69107d7cb3c54d602404b37917510b0054c23

    • SSDEEP

      384:jmF/v4fhSQfOwAPnACI1VoP/aJuzgSk2C8RlWWVKlGzMNNGd2h0omd:jS/GLlAvIVoHFg6nKevd

    • Andromeda family

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks