ammyyadmin | f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c

General

Target

f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c
Size

827KB
Sample

220725-d2td1sdafr
MD5

bb5bacfe2ae5bf6e02f5aa5f55c28acf
SHA1

c49192478c9611df1fde63fdd1f848def716fcba
SHA256

f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c
SHA512

f59a33f7bac0f8efab55c00e5e5be44c1db9ed859c7e6ffe563d43767d7c71ed902831739dea211d05ef6920ad2b13e7b76e824c88ade01e3cdf441fa524a8fc

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c
- Size
  
  827KB
- MD5
  
  bb5bacfe2ae5bf6e02f5aa5f55c28acf
- SHA1
  
  c49192478c9611df1fde63fdd1f848def716fcba
- SHA256
  
  f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c
- SHA512
  
  f59a33f7bac0f8efab55c00e5e5be44c1db9ed859c7e6ffe563d43767d7c71ed902831739dea211d05ef6920ad2b13e7b76e824c88ade01e3cdf441fa524a8fc
Score

10^/10

ammyyadmin flawedammyy sality backdoor evasion rat trojan upx
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2