Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1282f6e8af...cN.exe

windows7-x64

10

1282f6e8af...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8cN.exe

  • Size

    145KB

  • Sample

    250112-fagl9ayqaq

  • MD5

    8af9d631e3b95e75f06de656920fad10

  • SHA1

    22be884c219889aaa83c9e3782758133f77b42d5

  • SHA256

    1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8c

  • SHA512

    29ab5304715512353a4f27f7d32a8e6bb7baee1b0c121783b388ccce15c6e5262abf94a08fff7081d6b6e7edbf409745bae667fd6cf8172f81c26dd90d24d903

  • SSDEEP

    3072:Y+EoUPRgWH18MmaqD1SdXL98N9r6UwUTUCt78HlR0s:EuYqMm716Blp

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8cN.exe

    • Size

      145KB

    • MD5

      8af9d631e3b95e75f06de656920fad10

    • SHA1

      22be884c219889aaa83c9e3782758133f77b42d5

    • SHA256

      1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8c

    • SHA512

      29ab5304715512353a4f27f7d32a8e6bb7baee1b0c121783b388ccce15c6e5262abf94a08fff7081d6b6e7edbf409745bae667fd6cf8172f81c26dd90d24d903

    • SSDEEP

      3072:Y+EoUPRgWH18MmaqD1SdXL98N9r6UwUTUCt78HlR0s:EuYqMm716Blp

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks