Case study: Andromeda

Andromeda is a now (mostly) dead worm that was first spotted in 2011. Andromeda used a number of techniques to infect hosts, but commonly was spotted on USB media when the following command was detected upon plugging in the drive:

C:\windows\system32\cmd.exe'' /c start rundll32 \ececacacaeaeaecececacacaeaeaecececacacaeaeaececca.ececacacaeaeaecececacacaeaeaecececacacaeaeaececca,CaWSOKGsokgcOKaY

Upon executing via runDLL32, the malware would first check to see if the machine was a VM or debugging workstation by utilizing a list of blacklisted processes in memory and comparing it to a list of running processes utilizing the CreateToolhelp32Snapshot API and then cycling through the processes.

If all checks were passed, the malware would then copy itself to %ALLUSERSPROFILE% and rename the binary randomly prepended with MS.

Finally, to achieve persistence, the Andromeda malware would create a value at registry key HKCU\Software\Microsoft\Windows...