Overview

overview

10

Static

static

10

AA39_55.exe

windows7-x64

10

AA39_55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AA39_55.exe

  • Size

    776KB

  • Sample

    230615-nsm6ragc22

  • MD5

    e3a944626a6932d5625b4e956781d8c5

  • SHA1

    21022d5300a201433e84b18f8e4f1c94fd0904fe

  • SHA256

    e682ea6f18a526c3f0d8e7b6f3673b05e8e211a29fe3274423756d4731289224

  • SHA512

    d9e43d846c74a3db8bf96aa554c6216119f89d296c85ab0396c5000944ed0e6cabcf8a6b437aa22feaac56584ad1fe167f98434b6551377b400dbda0f360659c

  • SSDEEP

    12288:KWeiVSRZI3HAaMhYBSJEKH0OERt4PMsajW0pSEVJjgjX:lHIZI3AaiYBSGKpERtMMRy0pDcjX

Score
10/10
ammyyadminflawedammyytrojan

Malware Config

Targets

    • Target

      AA39_55.exe

    • Size

      776KB

    • MD5

      e3a944626a6932d5625b4e956781d8c5

    • SHA1

      21022d5300a201433e84b18f8e4f1c94fd0904fe

    • SHA256

      e682ea6f18a526c3f0d8e7b6f3673b05e8e211a29fe3274423756d4731289224

    • SHA512

      d9e43d846c74a3db8bf96aa554c6216119f89d296c85ab0396c5000944ed0e6cabcf8a6b437aa22feaac56584ad1fe167f98434b6551377b400dbda0f360659c

    • SSDEEP

      12288:KWeiVSRZI3HAaMhYBSJEKH0OERt4PMsajW0pSEVJjgjX:lHIZI3AaiYBSGKpERtMMRy0pDcjX

    Score
    10/10
    flawedammyytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks