ammyyadmin | be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65 | Triage

Submit
Reports

Overview

overview

Static

static

be7da4a4eb...65.exe

windows7-x64

be7da4a4eb...65.exe

windows10-2004-x64

Sharing

General

Target

be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65
Size

825KB
Sample

221029-f3xtyacfd2
MD5

b4ac3a610662ffcc285a098ab43f6970
SHA1

1d0a2b0924de9d9afed132d5e8b6214dc1dfc9e5
SHA256

be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65
SHA512

6cc4f2845dc9770b7caff501d568e43936ff3cce0e2ccb0010c15c3ca179a2ff9a80eca4abe2f3c7ddb4f8f2574fa567bb1dc4bfb8c9be5701e2d555d9b7d65f
SSDEEP

24576:PkK+waI8JRQMEJ2rufRtse9r0v8MlBiIwuD0w6RAfEy:c4aSlx8lBi7E0lSfEy

Score

10^/10

ammyyadmin flawedammyy rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65.exe

Resource

win7-20220812-en

flawedammyy trojan

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65.exe

Resource

win10v2004-20220901-en

ammyyadmin flawedammyy rat trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65
- Size
  
  825KB
- MD5
  
  b4ac3a610662ffcc285a098ab43f6970
- SHA1
  
  1d0a2b0924de9d9afed132d5e8b6214dc1dfc9e5
- SHA256
  
  be7da4a4eb534744bba008b2ff12f4f72b09432d1c1a27d2a1dc76fc0737bd65
- SHA512
  
  6cc4f2845dc9770b7caff501d568e43936ff3cce0e2ccb0010c15c3ca179a2ff9a80eca4abe2f3c7ddb4f8f2574fa567bb1dc4bfb8c9be5701e2d555d9b7d65f
- SSDEEP
  
  24576:PkK+waI8JRQMEJ2rufRtse9r0v8MlBiIwuD0w6RAfEy:c4aSlx8lBi7E0lSfEy
Score

10^/10

flawedammyy trojan ammyyadmin rat
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

flawedammyytrojan

behavioral2

ammyyadminflawedammyyrattrojan

© 2018-2025

Terms | Privacy