Overview

overview

10

Static

static

5

ecd918c004...18.exe

windows7-x64

10

ecd918c004...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecd918c00473aecebd19ce6bf5ee447c_JaffaCakes118

  • Size

    329KB

  • Sample

    241213-1kldeayqbw

  • MD5

    ecd918c00473aecebd19ce6bf5ee447c

  • SHA1

    146b046833b27554d34cb014c43c0d9a3cc73a39

  • SHA256

    75783908850a1c923af9f91747083043f9fad06e7f601079144b05721f3701d9

  • SHA512

    e10437721c9cf7bdc6b23e4a9a6c3239359455941016a2eb2deb31465bb1971311289cd57cdd6cba1951e2440cf0029c28cbdb4ef93973723990b238bfae927c

  • SSDEEP

    6144:ADBSP9c0wEjnb1QP4A8bKkfjLd8wTmbppIxII+DGI/ls:ANSPB1PDbKk7Lq4mbI+Ds

Score
10/10
andromedabackdoorbotnetdiscoverypersistenceupx

Malware Config

Targets

    • Target

      ecd918c00473aecebd19ce6bf5ee447c_JaffaCakes118

    • Size

      329KB

    • MD5

      ecd918c00473aecebd19ce6bf5ee447c

    • SHA1

      146b046833b27554d34cb014c43c0d9a3cc73a39

    • SHA256

      75783908850a1c923af9f91747083043f9fad06e7f601079144b05721f3701d9

    • SHA512

      e10437721c9cf7bdc6b23e4a9a6c3239359455941016a2eb2deb31465bb1971311289cd57cdd6cba1951e2440cf0029c28cbdb4ef93973723990b238bfae927c

    • SSDEEP

      6144:ADBSP9c0wEjnb1QP4A8bKkfjLd8wTmbppIxII+DGI/ls:ANSPB1PDbKk7Lq4mbI+Ds

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistenceupx

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks