General

  • Target

    a10188ceb3df546acbc5b6917d81fdff71519359badaf0c16aaa45d9f09a046eN.exe

  • Size

    392KB

  • Sample

    241216-gyadhsxpay

  • MD5

    aae54a9b810a2a8d05a446219de34960

  • SHA1

    f1a0eafbdb1761ce6b7ac08d1423b3aa135f9ae7

  • SHA256

    a10188ceb3df546acbc5b6917d81fdff71519359badaf0c16aaa45d9f09a046e

  • SHA512

    11bfb38f87f8f9b6380fc4d1f86220296439efa84684abdcee232e9e6d77104c7aa88b1283df8c82eaa6dd462bf4824cb1ee9c02ac3d386c4b8a8c5d65fcdd49

  • SSDEEP

    3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV2:DPA6wxmuJspr2lb6

Malware Config

Targets

    • Target

      a10188ceb3df546acbc5b6917d81fdff71519359badaf0c16aaa45d9f09a046eN.exe

    • Size

      392KB

    • MD5

      aae54a9b810a2a8d05a446219de34960

    • SHA1

      f1a0eafbdb1761ce6b7ac08d1423b3aa135f9ae7

    • SHA256

      a10188ceb3df546acbc5b6917d81fdff71519359badaf0c16aaa45d9f09a046e

    • SHA512

      11bfb38f87f8f9b6380fc4d1f86220296439efa84684abdcee232e9e6d77104c7aa88b1283df8c82eaa6dd462bf4824cb1ee9c02ac3d386c4b8a8c5d65fcdd49

    • SSDEEP

      3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV2:DPA6wxmuJspr2lb6

    • Andromeda family

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks