Extracted

• • Target

    4e607404e9e8134c2ab85929154bd12972001fff086967930d5170d0de4f612d

  • Size

    1.1MB

  • MD5

    efd0cb9e9e31c798eb5a3da36ba6b93b

  • SHA1

    d9fd375908375753192918469edaa4a0e9b24ce6

  • SHA256

    4e607404e9e8134c2ab85929154bd12972001fff086967930d5170d0de4f612d

  • SHA512

    23df02cc3ca3d601c51467796d10ccecc7bb80ae152dacb0b439e6a95d0149bb5c3f824b20149c1efcc7f8194213f5a71b06a3b1453821fb3562c9e2d3c048af

  • SSDEEP

    24576:dnLooh+Op/CyXEQhDbFVuxTrnfpVOVFB4upovJqzuxTY:hLoohHp/ClSbFERfpVaIbS

  Score

  10^/10

  ammyyadmincybergateflawedammyytadeupratiqueratstealertrojanupx

  • Ammyy Admin

    Remote admin tool with various capabilities.

    ratammyyadmin

  • AmmyyAdmin payload

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

    trojanflawedammyy

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2