Overview

overview

10

Static

static

1

PaymentPro...JC.exe

windows7-x64

10

PaymentPro...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PaymentProofsigned_JC.exe

  • Size

    8.0MB

  • Sample

    230906-v55d5aac2s

  • MD5

    302ed52d9459e06cc2d4b81de0e2295c

  • SHA1

    73049a2f4f19b01adb05df3c3d073cb6066169e6

  • SHA256

    c4c0df629f8dbb15bf56089c1bb1f31e4fcc485376ec771942a997bb1654ee9b

  • SHA512

    12fcc7521996f39ea48025e5dc2932901797b537b85e2552b9029c13cfbdd220b2de7291b92907bc1bdb3dcb765f28a56ed338230befeb710ec2521a52c8d0c7

  • SSDEEP

    196608:K2stp2jOusPS2pYOUL2SQppEvoLSS167JaOTp:GqO9S2uQ0voLSS16VaOt

Score
10/10
ammyyadminpersistencerat

Malware Config

Targets

    • Target

      PaymentProofsigned_JC.exe

    • Size

      8.0MB

    • MD5

      302ed52d9459e06cc2d4b81de0e2295c

    • SHA1

      73049a2f4f19b01adb05df3c3d073cb6066169e6

    • SHA256

      c4c0df629f8dbb15bf56089c1bb1f31e4fcc485376ec771942a997bb1654ee9b

    • SHA512

      12fcc7521996f39ea48025e5dc2932901797b537b85e2552b9029c13cfbdd220b2de7291b92907bc1bdb3dcb765f28a56ed338230befeb710ec2521a52c8d0c7

    • SSDEEP

      196608:K2stp2jOusPS2pYOUL2SQppEvoLSS167JaOTp:GqO9S2uQ0voLSS16VaOt

    Score
    10/10
    ammyyadminpersistencerat

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Creates new service(s)

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks