← Back to SOC feed Coverage →

Identify Andromeda

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-12T23:00:00Z · Confidence: medium

Hunt Hypothesis

Andromeda is a sophisticated malware that may execute stealthily within a network, leveraging Azure services to maintain persistence and exfiltrate data. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced threats that evade traditional detection methods.

YARA Rule

rule andromeda
{
    
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "[email protected]"
        date = "2014-03-13"
        description = "Identify Andromeda"
    
    strings:
        $config = {1c 1c 1d 03 49 47 46}
        $c1 = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst"
    
    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_Andromeda.yar