General

  • Target

    ac3e3f7c2308062b64aa1130eb6fa108a22b01f364d9805d7e2923a2c702d70a.exe

  • Size

    392KB

  • Sample

    241210-hx9bwsxrgw

  • MD5

    5af4395d5b87192512c437a8b0044f02

  • SHA1

    1bb129c2acf91a3c6041c31394ba2891e57eb420

  • SHA256

    ac3e3f7c2308062b64aa1130eb6fa108a22b01f364d9805d7e2923a2c702d70a

  • SHA512

    4aaf9cc1b211591de04f525a0fcf6215fb49ad094378cad0a6af4caa5fe86949cf3cb8b848b4c6a2e79393044add39af6fe583b6bb81ac4d633ace623476f864

  • SSDEEP

    3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV27:DPA6wxmuJspr2lb6i

Malware Config

Targets

    • Target

      ac3e3f7c2308062b64aa1130eb6fa108a22b01f364d9805d7e2923a2c702d70a.exe

    • Size

      392KB

    • MD5

      5af4395d5b87192512c437a8b0044f02

    • SHA1

      1bb129c2acf91a3c6041c31394ba2891e57eb420

    • SHA256

      ac3e3f7c2308062b64aa1130eb6fa108a22b01f364d9805d7e2923a2c702d70a

    • SHA512

      4aaf9cc1b211591de04f525a0fcf6215fb49ad094378cad0a6af4caa5fe86949cf3cb8b848b4c6a2e79393044add39af6fe583b6bb81ac4d633ace623476f864

    • SSDEEP

      3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV27:DPA6wxmuJspr2lb6i

    • Andromeda family

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks