Overview

overview

10

Static

static

10

7a836e718b...81.exe

windows7-x64

10

7a836e718b...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a836e718b70f586695d1bced9eacfb1aa1b67387b051d0536669754b391fe81

  • Size

    751KB

  • Sample

    221209-x32assdh98

  • MD5

    1fc7c230d6db0d7a0da6f415da271159

  • SHA1

    e0bd10d83bc7b3f1eb628974a8f690ffda6e9351

  • SHA256

    7a836e718b70f586695d1bced9eacfb1aa1b67387b051d0536669754b391fe81

  • SHA512

    96d64cba5bf650066e54bcb84f13aabd1992811963ae2dd3530431e86bbc3230d673545953d35767fbf85f61d86b44170d61200d1ffb4f4945268bfc3a7b1403

  • SSDEEP

    12288:Tc1dZibTD9uOroAgeHvCUt4RtlTc+YNKpQsNvVd1gF:Tcc/DwOrZgeHv54Rt6+YNkQsNmF

Score
10/10
ammyyadminflawedammyytrojan

Malware Config

Targets

    • Target

      7a836e718b70f586695d1bced9eacfb1aa1b67387b051d0536669754b391fe81

    • Size

      751KB

    • MD5

      1fc7c230d6db0d7a0da6f415da271159

    • SHA1

      e0bd10d83bc7b3f1eb628974a8f690ffda6e9351

    • SHA256

      7a836e718b70f586695d1bced9eacfb1aa1b67387b051d0536669754b391fe81

    • SHA512

      96d64cba5bf650066e54bcb84f13aabd1992811963ae2dd3530431e86bbc3230d673545953d35767fbf85f61d86b44170d61200d1ffb4f4945268bfc3a7b1403

    • SSDEEP

      12288:Tc1dZibTD9uOroAgeHvCUt4RtlTc+YNKpQsNvVd1gF:Tcc/DwOrZgeHv54Rt6+YNkQsNmF

    Score
    10/10
    flawedammyytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks