Trusted Design

Andromeda Botnet Targets Italy in Recent Spam Campaigns

概要

Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy. The spam emails attempt to install the pervasive Andromeda malware onto victim machines. This malware has been around since 2011 and shows no signs of stopping. Compromised hosts cause a victim’s machine to be attached to the Andromeda botnet, giving attackers the ability to push plugins or additional malware onto these machines.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 6afafa23a357226c7c87854eefe03d82556944ef7319aac0897cca1e9bad4f86 -
• FileHash-SHA256 - f7a07211fb96425d9cc74eed1e673918177ed155cd9118fcad132d5c994e0c54 -
• FileHash-SHA256 - be89fbbcbc98cb7cf54223c1a06bc59134e5f82e83fc577618fc6c6fdcf3129c -
• FileHash-SHA256 - ed096a3bdb59308343da3a599d55a593568b86cd88389f9fc054aa009c15a9fd -
• FileHash-SHA256 - c85e6c218e4591d48d19fae9b12db30856da245a28bafc9735e4404b794ca263 -
• FileHash-SHA256 - 6439ca529257f15450606dbd80847cb6f6c4024c2447510bc30e7d29a333355e -
• FileHash-SHA256 - 490d3160da50f61a150365bb0719dfb36f1c1c13ab7b80d783d7611450478505 -
• FileHash-SHA256 - 9e8b1f4e53d545858709c7a10ca70e766474cc168640bada1c6fb14f38d80e42 -
• FileHash-SHA256 - 24f78fb42db6184a9919a66afa59ecb12705b4bf32c97d23b9fa46ff969f3697 -
• FileHash-SHA256 - 5f344ae4e45a61a3b9f22a5019fd0a0df4b6388a5aadaa18dbe7e576a9212ef5 -
• FileHash-SHA256 - e3eeccbb66a7aedc7bfc9006d8a42a4b79ce0677d6be2d2e6bd480dea2d26852 -
• FileHash-SHA256 - a8620a774c7a22e37a02c5caff85fe2e8f9dcf3b49dd105fcdefc153d4a2828c -
• FileHash-SHA256 - bd2b323b2ec26be8936839b6b8e2b0874d28e2370371f415a6e8559bfa236dc0 -
• FileHash-SHA256 - 4c519dc75e7f12cdbd7b2a9a378a4a370ade42dd34e2b4d57c72ba9c7c8ee80a -
• FileHash-SHA256 - f144e5a238964c803719aa7928fa86958d94bab5a6be3777ac068d6d872c3ffb -
• FileHash-SHA256 - 833b280f48809d15c81309915399c5325dd68bf83ebc9924aa68c96ec9345e4f -
• FileHash-SHA256 - 6001bcae5a14acf20e246bf9973af47dfd144c9a27ebc7ed0311b68c2e782cd7 -
• FileHash-SHA256 - 5ab435aff9015ecd2e5f111ff64f6e28ed2f0473322f607a20d851e6413ba43e -
• FileHash-SHA256 - 1f4295448d294cf2a154e9df31d5ce1f9bde8a9aa560fe33396c5a66beb0da87 -
• FileHash-SHA256 - 7904410713542907d98409a64778d98db3c195ee1a4c712a136211c1c02a27ec -
• FileHash-SHA256 - 47c41b0e320df279f25858c74770182eaccb4126b21147dc2605a3f3505a6e6f -
• FileHash-SHA256 - f237a91297ac3f1cc730c77edc1090f7b1c8c1d5da0bf4a44411c88e3cbba6db -

類似Pulses

• Andromeda Botnet (score: 0.75)
• GamaPoS: The Andromeda Botnet Connection (score: 0.73)
• Gamarue dropping Lethic bot (score: 0.61)
• IBM Trusteer: Mazain Mobile Bot Sees Increasing Prevalence in France and Spain (score: 0.60)
• A New All-in-One Botnet: Proteus (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る