andromeda | e5e0303841d217bb73f26c57848908d9c8c71478bc992b0a841475c39b59cb28

Resubmissions

16/01/2025, 06:01

250116-gq1whavrgy 10

16/01/2025, 05:29

250116-f6vtravrfn 10

Sharing

Copy URL

Twitter E-mail

General

Target

e5e0303841d217bb73f26c57848908d9c8c71478bc992b0a841475c39b59cb28.exe
Size

284KB
Sample

250116-gq1whavrgy
MD5

35b803718620e93d26e57596887ccfd4
SHA1

61e4a8cb8cc84acd6a846236964c2dc97065d346
SHA256

e5e0303841d217bb73f26c57848908d9c8c71478bc992b0a841475c39b59cb28
SHA512

9bfa9aff504396b08415a0361f34e985c9dde2e109d8a3d5dec71a83bf25b832781572ccc6164c23d602807fc108b2f53e41874578a5d4afb88b2c81f73bfe12
SSDEEP

3072:mSQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lCi:mPA6wxmuJspr2l3

Score

10^/10

Malware Config

Targets

- Target
  
  e5e0303841d217bb73f26c57848908d9c8c71478bc992b0a841475c39b59cb28.exe
- Size
  
  284KB
- MD5
  
  35b803718620e93d26e57596887ccfd4
- SHA1
  
  61e4a8cb8cc84acd6a846236964c2dc97065d346
- SHA256
  
  e5e0303841d217bb73f26c57848908d9c8c71478bc992b0a841475c39b59cb28
- SHA512
  
  9bfa9aff504396b08415a0361f34e985c9dde2e109d8a3d5dec71a83bf25b832781572ccc6164c23d602807fc108b2f53e41874578a5d4afb88b2c81f73bfe12
- SSDEEP
  
  3072:mSQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lCi:mPA6wxmuJspr2l3
Score

10^/10

discovery persistence upx andromeda backdoor botnet
- Andromeda family
  andromeda
- Andromeda, Gamarue
  Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
  botnet backdoor andromeda
- Detects Andromeda payload.
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Andromeda family

Andromeda, Gamarue

Detects Andromeda payload.

Adds policy Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10