Overview

overview

10

Static

static

3

JaffaCakes...e2.exe

windows7-x64

10

JaffaCakes...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_51cfa17bd34278941d3ddac3222d3ee2

  • Size

    50KB

  • Sample

    250305-m9bcvaw1bw

  • MD5

    51cfa17bd34278941d3ddac3222d3ee2

  • SHA1

    0ebd9f23bf99670cd1506337ba367e39953eaae8

  • SHA256

    f2aee5f92daf790caf68d6652d19f4cc22508220063c3b802de4262b2003512e

  • SHA512

    0d13743b9566ed02849b49f96d5d4cafb0d921cddd97536494d323eac5eb72a618b835aa2a5471bb49c006343e3c68e7d31ea5bdbeab40fdfebe190a5d0f462a

  • SSDEEP

    768:V1QM9CFilbA7Oc5fpVZRYMMDHjvEX2nT+ipe8tDWU/LR2NBZpmjEJ+lC:xWi5AzfXYMMHY2nT+ipeYv2ND4xC

Score
10/10
andromedabackdoorbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      JaffaCakes118_51cfa17bd34278941d3ddac3222d3ee2

    • Size

      50KB

    • MD5

      51cfa17bd34278941d3ddac3222d3ee2

    • SHA1

      0ebd9f23bf99670cd1506337ba367e39953eaae8

    • SHA256

      f2aee5f92daf790caf68d6652d19f4cc22508220063c3b802de4262b2003512e

    • SHA512

      0d13743b9566ed02849b49f96d5d4cafb0d921cddd97536494d323eac5eb72a618b835aa2a5471bb49c006343e3c68e7d31ea5bdbeab40fdfebe190a5d0f462a

    • SSDEEP

      768:V1QM9CFilbA7Oc5fpVZRYMMDHjvEX2nT+ipe8tDWU/LR2NBZpmjEJ+lC:xWi5AzfXYMMHY2nT+ipeYv2ND4xC

    Score
    10/10
    andromedabackdoorbotnetdiscoverypersistence

    • Andromeda family

      andromeda

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

      botnetbackdoorandromeda

    • Detects Andromeda payload.

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks