General
- Target JaffaCakes118_3eb8dd8902358c1877aa7eaa0fa2078b
- Size 76KB
- Sample260102-n6efrsfm6t
- SHA256 2bec9a69b8270cb1f524230d253e13199e259b3a5459a5d41cdbebaa7e62989a
Score
10/10
Malware Config
Targets
-
- Target JaffaCakes118_3eb8dd8902358c1877aa7eaa0fa2078b
- Size 76KB
- SHA256 2bec9a69b8270cb1f524230d253e13199e259b3a5459a5d41cdbebaa7e62989a
Score10/10-
Andromeda family
-
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
-
Detects Andromeda payload.
-
Adds policy Run key to start application
-
Deletes itself
-
Loads dropped DLL
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
Score3/10 -
- Target $TEMP/Jekigugam.dll
- Size 6KB
- SHA256 00ca3f17239b56d1fb1e1d836c311c771369d706f1e163ed11c663e139edbd10
Score3/10 -
- Target $TEMP/Wirododojo.dll
- Size 3KB
- SHA256 d3cbbd6fea6309000c963bb64a82e93a705cbb528fc6bd51adcfeaad5517c986
Score3/10 -
- Target $TEMP/fuyonuja.dll
- Size 4KB
- SHA256 b2f772d1faea0fb8ba888fc884965124ea77101b16b1e4f344251c11b6419ac1
Score3/10