Overview

overview

10

Static

static

1

2c6daaf2cf...d4.exe

windows7-x64

10

2c6daaf2cf...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c6daaf2cf193afdc8557069be4b7e344e3fd3b727a66e2dff450f80a2cf09d4

  • Size

    769KB

  • Sample

    221125-2ckmksbd64

  • MD5

    cf8d441c3959c5a09b18b21e231d89bd

  • SHA1

    927584c9b3cad98065c1f1a975e68f2fbd19161c

  • SHA256

    2c6daaf2cf193afdc8557069be4b7e344e3fd3b727a66e2dff450f80a2cf09d4

  • SHA512

    f0c53b7f6504bebed71bb4eb6f82049fcbe292c4e8bfc329091ff459fdaf2092e0f7ae8851e474d2076b8881c971180109ab482ee0d0b4f9bafe572886bdd888

  • SSDEEP

    12288:RC76zMontVWUL0YCb6HIKDW4eV9uOxZbYESS/gudZQFR2EH9kC0T2e9NkrsUEE0X:REWWpeB2V9u0iK//0DQrkeEmh9z

Score
10/10
ammyyadminflawedammyyevasionpersistencerattrojan

Malware Config

Targets

    • Target

      2c6daaf2cf193afdc8557069be4b7e344e3fd3b727a66e2dff450f80a2cf09d4

    • Size

      769KB

    • MD5

      cf8d441c3959c5a09b18b21e231d89bd

    • SHA1

      927584c9b3cad98065c1f1a975e68f2fbd19161c

    • SHA256

      2c6daaf2cf193afdc8557069be4b7e344e3fd3b727a66e2dff450f80a2cf09d4

    • SHA512

      f0c53b7f6504bebed71bb4eb6f82049fcbe292c4e8bfc329091ff459fdaf2092e0f7ae8851e474d2076b8881c971180109ab482ee0d0b4f9bafe572886bdd888

    • SSDEEP

      12288:RC76zMontVWUL0YCb6HIKDW4eV9uOxZbYESS/gudZQFR2EH9kC0T2e9NkrsUEE0X:REWWpeB2V9u0iK//0DQrkeEmh9z

    Score
    10/10
    ammyyadminflawedammyyevasionpersistencerattrojan

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Privilege Escalation

New Service

1
T1050

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks