ammyyadmin | 7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066 | Triage

Submit
Reports

Overview

overview

Static

static

7b49ac2b50...66.exe

windows7-x64

7b49ac2b50...66.exe

windows10-2004-x64

Sharing

General

Target

7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066
Size

1016KB
Sample

221020-khh79sdgaq
MD5

772d79fe2b7df4b0334920e1b29d8f00
SHA1

cef1953d61603d9da4297f55436e41529a4ef4ed
SHA256

7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066
SHA512

e2dd50a3d8ea7963a5ae5ed52433497daca235b1d5403640b596297064cb3757ff911f289f3e608f494596c2ebcdceecba558cf5c82dce9d1a60972add566d49
SSDEEP

24576:nTOpdDcQiOEDE9QE5C5kSYJiCJ6WAUk8g0rG1RSatmYC:TuiXoQE05kliCJkUPgBma0YC

Score

10^/10

ammyyadmin flawedammyy rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066.exe

Resource

win7-20220812-en

ammyyadmin flawedammyy rat trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066.exe

Resource

win10v2004-20220812-en

ammyyadmin flawedammyy rat trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066
- Size
  
  1016KB
- MD5
  
  772d79fe2b7df4b0334920e1b29d8f00
- SHA1
  
  cef1953d61603d9da4297f55436e41529a4ef4ed
- SHA256
  
  7b49ac2b5020f6d02c41647c8520690a172ff0c7e1f372e47342520fc1ab7066
- SHA512
  
  e2dd50a3d8ea7963a5ae5ed52433497daca235b1d5403640b596297064cb3757ff911f289f3e608f494596c2ebcdceecba558cf5c82dce9d1a60972add566d49
- SSDEEP
  
  24576:nTOpdDcQiOEDE9QE5C5kSYJiCJ6WAUk8g0rG1RSatmYC:TuiXoQE05kliCJkUPgBma0YC
Score

10^/10

ammyyadmin flawedammyy rat trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ammyyadminflawedammyyrattrojan

behavioral2

ammyyadminflawedammyyrattrojan

© 2018-2025

Terms | Privacy