General

  • Target

    PaymentProf.zip

  • Size

    7.7MB

  • Sample

    230906-qacy6sfe56

  • MD5

    ff139aa66d20be99c34f5e9daec7726b

  • SHA1

    6f3500c343c7ec13e7ab3b304df735a0b96f29a3

  • SHA256

    8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9

  • SHA512

    69342842510445e0ba4a7d5279672f71efb73ba61a8087dc28e0b698e3462ed9e21051077aa2e5441cc4a4c6842af937b85a4a4bcd802e96f8b261ef92fc73f6

  • SSDEEP

    196608:OzRuAFSr+5tgeTsg+Jlegqf6oxDUX2Wj3JoNzr:OzDFsugkl+SpxD2ZUzr

Malware Config

Targets

    • Target

      PaymentProofsigned.exe

    • Size

      8.0MB

    • MD5

      302ed52d9459e06cc2d4b81de0e2295c

    • SHA1

      73049a2f4f19b01adb05df3c3d073cb6066169e6

    • SHA256

      c4c0df629f8dbb15bf56089c1bb1f31e4fcc485376ec771942a997bb1654ee9b

    • SHA512

      12fcc7521996f39ea48025e5dc2932901797b537b85e2552b9029c13cfbdd220b2de7291b92907bc1bdb3dcb765f28a56ed338230befeb710ec2521a52c8d0c7

    • SSDEEP

      196608:K2stp2jOusPS2pYOUL2SQppEvoLSS167JaOTp:GqO9S2uQ0voLSS16VaOt

    • Ammyy Admin

      Remote admin tool with various capabilities.

    • AmmyyAdmin payload

    • Creates new service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks