Overview

overview

10

Static

static

3

2e60d50e33...fN.exe

windows7-x64

10

2e60d50e33...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e60d50e334e7cb3c6909d80e483f76dead0518af306ba9ddda92375a3e6c3ffN.exe

  • Size

    145KB

  • Sample

    250225-d1mj3s1ns9

  • MD5

    1fbf613c905f75f696344844e5e7cb20

  • SHA1

    b65c73f6f404aa1deb283d9c2767075b196b6a29

  • SHA256

    2e60d50e334e7cb3c6909d80e483f76dead0518af306ba9ddda92375a3e6c3ff

  • SHA512

    5465807b2e1d0d17ee0372ef3a3c21f6f29ad92c6df159d00ecdb617cc26a224953d1e717ab6d42c4fae95a3b60069fde73732e0b9891c1c43a567657834605c

  • SSDEEP

    1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+AnqXw/hCxueh1:2++TFnoWTTYBB1hHgN1AnqdJr

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      2e60d50e334e7cb3c6909d80e483f76dead0518af306ba9ddda92375a3e6c3ffN.exe

    • Size

      145KB

    • MD5

      1fbf613c905f75f696344844e5e7cb20

    • SHA1

      b65c73f6f404aa1deb283d9c2767075b196b6a29

    • SHA256

      2e60d50e334e7cb3c6909d80e483f76dead0518af306ba9ddda92375a3e6c3ff

    • SHA512

      5465807b2e1d0d17ee0372ef3a3c21f6f29ad92c6df159d00ecdb617cc26a224953d1e717ab6d42c4fae95a3b60069fde73732e0b9891c1c43a567657834605c

    • SSDEEP

      1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+AnqXw/hCxueh1:2++TFnoWTTYBB1hHgN1AnqdJr

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks