Destruction Level:<\/strong> Moderate<\/p>\n Prevalence:<\/strong>\u00a0High<\/p>\n \u2022 Trojan.Win32.Andromeda Trojans are malware types that introduce themselves as healthy and legal software and act similarly to practical and applicable software but cause many destructions to the system when executing. The downloaded software from the internet, placing HTML text, attaching it to an email, etc. are ways that Trojans are using to enter the system. Contrary to viruses and computer worms, Trojans are not reproducible.<\/p>\n Andromeda malware has the\u00a0nature of the bot that by connecting to the network and injecting code into the victim’s healthy processes, it can download and execute other malicious files, as well as it can steal information from the victim’s system and send it to specific servers.\u00a0This malware is a bot instance of the Gamarue malware suite.<\/p>\n Symptoms of infection with this malware include the following:<\/p>\n In this section we will analyze two old and new versions of this malware:<\/p>\n This malware is a\u00a0http_based\u00a0bot that after infecting the system, it connects to the bot network. This bot is modular and if necessary, it downloads the module from its server and updates them.<\/p>\n The malware file size is large and varies from sample to sample. The malware appears to have the ability to modify the contents of its files and\u00a070MB of it is useless content (according to the reviews during the analysis, it seems that the volume of the main content is only\u00a05KB approximately) This prevents it from being detected by antiviruses. On the other hand, due to its high volume, the malware cannot be detected and checked on analytics sites.<\/p>\n The authors of the malware have made every effort to provide examples of this malware from packers and\u00a0decoder\u200cs and used different methods to make it difficult for antivirus to detect.<\/p>\n Initially, the malware disables the “Windows error notifications”. It then checks the languages installed on the victim system. Below is a list of countries that Gamarure does not intend to run on their systems.<\/p>\n Ukrainian<\/p>\n<\/li>\n Belarusian<\/p>\n<\/li>\n Kazakh<\/p>\n<\/li>\n Russian<\/p>\n<\/li>\n<\/ul>\n Installed languages on the system will be checked in different parts of the program to prevent some malicious activities in Russian, Ukrainian, Belarusian, or Kazakhistanian. Malware uses Network Time Protocol (NTP)\u00a0to get the current time. To do this, it’s going to the NTP\u00a0domains\u00a0and receives the time, so, it starts from the first domain mentioned below and if it fails, it will continue its efforts with other domains.<\/p>\n \u2022 north-america.pool.ntp.org You can view the Andromeda process in the following image. This malware injects malicious codes inside the svchost.exe or wuauclt.exe processes.<\/p>\n Also, it can contain the following extensions:<\/p>\n In some paths, it also copies itself with a name containing ‘ms’ letters:<\/p>\n Registry changes:<\/p>\n This malware performs changes in the registry to remain on the system so it can automatically operate after each OS boot.<\/p>\n <\/p>\n Network connection:<\/p>\n This malware tries to connect with its C&C which you can view its address in the following image:<\/p>\n The Andromeda transacted packets with its C&C is as follows:<\/p>\nMalware names<\/h3>\n
\n\u2022 Downloader.Win32.Andromeda<\/p>\nWhat is a Trojan?<\/h3>\n
What is Andromeda trojan?<\/h3>\n
Technical information<\/h2>\n
Signs of infection<\/h3>\n
\n
\n
\n%SystemDrive% \\ ProgramData
\n%AppData% \\ Roaming<\/code><\/li>\n
\n\u201c%SystemDrive%\\ProgramData\\Local Settings\\Temp\\ms**...**.exe\u201d<\/code><\/li>\n
\n\u201c%AppData%\\Roaming\\winlogonr\\winlogonr.exe\"<\/code><\/li>\n<\/ol>\nDescribing Performance<\/h3>\n
\n
Performance_1<\/h4>\n<\/li>\n<\/ul>\n
\n
\n\u2022 south-america.pool.ntp.org
\n\u2022 asia.pool.ntp.org
\n\u2022 oceania.pool.ntp.org
\n\u2022 africa.pool.ntp.org
\n\u2022 north-america.pool.ntp.org
\n\u2022 pool.ntp.org<\/p>\n\n
Performance_2<\/h4>\n<\/li>\n<\/ul>\n
![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda1.png\")
<\/p>\n![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda2.png\")
<\/p>\n![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda4.png\")
<\/p>\n\"AppData%\\Roaming\\winlogonr\\winlogonr.exe%\"<\/code><\/p>\n![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda5.png\")
<\/p>\nHKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\windows
\n<\/i>Value Name: Load<\/i>
\n<\/i>Value Data : %userprofile%\\Local Settings\\Temp\\ms<%s>.<%s><\/i><\/code><\/p>\nHKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\Policies\\Explorer\\Run
\n<\/i>Value Name: <%lu><\/i>
\n<\/i>Value Data :%allusersprofile%\\Local Settings\\Temp\\ms<%s>.<%s><\/i><\/code><\/p>\n![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda6.jpg\")
<\/p>\n![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda7.jpg\")
<\/p>\n![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda8.jpg\")
<\/p>\n\n
\n
![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda9.png\")
<\/li>\n<\/ul>\n<\/li>\n
![](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/01\/andromeda10.png\")
<\/p>\n