Overview

overview

10

Static

static

3

0611b864fd...3N.exe

windows7-x64

10

0611b864fd...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0611b864fd0164ba9a983de83ae9b6783d02808f0e3ca8c3df0b21226123d6f3N.exe

  • Size

    103KB

  • Sample

    241211-hf5mda1nht

  • MD5

    a1f4d3a5def450c7b69de6e81e3ba0e0

  • SHA1

    7320d121d9828efdf0b670ced16a990c2865b40f

  • SHA256

    0611b864fd0164ba9a983de83ae9b6783d02808f0e3ca8c3df0b21226123d6f3

  • SHA512

    43766fb2d1357a4fc3063ac02367d7f20403a019c0a94c03738de80a52b1fb0d65c9cfe1e37d30bdf094c471ddf62b4549d0cb3afc1fc8c1e05d7b191663a08e

  • SSDEEP

    1536:RLHT7gb3xn0dHoRnX3/wkBiGpRiWKXs4Tg:xfUBcoRnXPwciAEWKXsCg

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      0611b864fd0164ba9a983de83ae9b6783d02808f0e3ca8c3df0b21226123d6f3N.exe

    • Size

      103KB

    • MD5

      a1f4d3a5def450c7b69de6e81e3ba0e0

    • SHA1

      7320d121d9828efdf0b670ced16a990c2865b40f

    • SHA256

      0611b864fd0164ba9a983de83ae9b6783d02808f0e3ca8c3df0b21226123d6f3

    • SHA512

      43766fb2d1357a4fc3063ac02367d7f20403a019c0a94c03738de80a52b1fb0d65c9cfe1e37d30bdf094c471ddf62b4549d0cb3afc1fc8c1e05d7b191663a08e

    • SSDEEP

      1536:RLHT7gb3xn0dHoRnX3/wkBiGpRiWKXs4Tg:xfUBcoRnXPwciAEWKXsCg

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks