andromeda | 9ffaae7cfb1b1d4efc62fbaeeb2bd03023007c51a39b6316b4a01c21e4027ab7 | Triage

Sharing

General

Target

JaffaCakes118_897cb147efd1d13ce433ef6fefa1a94d
Size

33KB
Sample

250327-eff28syqv6
MD5

897cb147efd1d13ce433ef6fefa1a94d
SHA1

8c17ccd39cda879db649e1a8c7ad8085c5b8a719
SHA256

9ffaae7cfb1b1d4efc62fbaeeb2bd03023007c51a39b6316b4a01c21e4027ab7
SHA512

9fe1a61e0677104945a56683628bbbf88c8fc2fb1d0919d7f52ef6395714590aa2ae17a14338dcc059b5a7a34a87721857fdc6bd7b1f09e935b590d0f344be05
SSDEEP

768:LO3/ueuLtYDB2adeTYQITMFejvIKNUxlk4YqyUVgoJ5q:LOGeup+8abJwejwKyk1qjgoJ5q

Score

10^/10

andromeda backdoor botnet discovery persistence

Malware Config

Targets

- Target
  
  Hotel-Booking_Confirmation.exe
- Size
  
  53KB
- MD5
  
  9a01293b87b058619d55b8d4d12f2a8e
- SHA1
  
  79a2efa68564c2d8ebc87c80746e2d2ec955b726
- SHA256
  
  7f472d30ba32d6df227b13160ab7e9da6fe4cc91f34425172e77fc8474b7b082
- SHA512
  
  1f5e308c661741bc504cb1cdce957f8d52f9bcbbd9bac35f077133a0c7d127237e2d714a8d963d5fec46e1da66b6391eff418d4d0a001c0a996c334441f688eb
- SSDEEP
  
  768:cQ8BIP2feSDYQTtarK36u7Qb/MuSiCTesykqRx0x2tcKZGF81G6p9cyVOAa4yEDL:mIPuePS8lrJ/trZG+t7cyVP1yPq
Score

10^/10

andromeda backdoor botnet discovery persistence
- Andromeda family
  andromeda
- Andromeda, Gamarue
  Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
  botnet backdoor andromeda
- Detects Andromeda payload.
- Adds policy Run key to start application
  persistence
- Deletes itself
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

andromedabackdoorbotnetdiscoverypersistence

behavioral2

andromedabackdoorbotnetdiscoverypersistence