andromeda | 11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67 | Triage

Submit
Reports

Overview

overview

Static

static

3

11d657139b...67.exe

windows7-x64

11d657139b...67.exe

windows10-2004-x64

Sharing

General

Target

11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67
Size

144KB
Sample

250310-ypfmlsw1dv
MD5

8685905a52e46cde7e2b3b113d6769b9
SHA1

f78c3b87d4acb952d58ee5bf40c42c103323d03c
SHA256

11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67
SHA512

782a86a027d9d52c316080c9aab3c2006ff7e8afda2588ea6d193f3cf9ede0ec3506698e806c0b50acc41711ee294ec7639be05f7975a51df0400fc7a13cc36d
SSDEEP

3072:jW5MbnownJBRxteYScB0C5omskBTU87wP7H:jgsJHHehQv5nB6

Score

10^/10

andromeda backdoor botnet discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67.exe

Resource

win7-20240903-en

andromeda backdoor botnet discovery persistence

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67.exe

Resource

win10v2004-20250217-en

andromeda backdoor botnet discovery persistence

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67
- Size
  
  144KB
- MD5
  
  8685905a52e46cde7e2b3b113d6769b9
- SHA1
  
  f78c3b87d4acb952d58ee5bf40c42c103323d03c
- SHA256
  
  11d657139bbb81072c0354811e25835599b2e51475ef0013f3bac309a9d9ea67
- SHA512
  
  782a86a027d9d52c316080c9aab3c2006ff7e8afda2588ea6d193f3cf9ede0ec3506698e806c0b50acc41711ee294ec7639be05f7975a51df0400fc7a13cc36d
- SSDEEP
  
  3072:jW5MbnownJBRxteYScB0C5omskBTU87wP7H:jgsJHHehQv5nB6
Score

10^/10

andromeda backdoor botnet discovery persistence
- Andromeda family
  andromeda
- Andromeda, Gamarue
  Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
  botnet backdoor andromeda
- Detects Andromeda payload.
- Adds policy Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

andromedabackdoorbotnetdiscoverypersistence

behavioral2

andromedabackdoorbotnetdiscoverypersistence

© 2018-2025

Terms | Privacy