Extracted

• • Target

    6Js1.bin

  • Size

    618KB

  • MD5

    3f6d5376b6d40c82644287c7621dfc5b

  • SHA1

    f54b9ed42b60eb6793cd55ed25e6f2bd6120218f

  • SHA256

    94dbf6089ceccafd34ec1011941f18682361d71a9fbc54d1495dc0f9ec52169e

  • SHA512

    3ea3e7c045c015e8c455ed9f550784d7af75c2cba263913ffaa210652f74ed036a6541b71f95d11663ee6dd062059cbcad94c1148243852d01722dd8780d010c

  • SSDEEP

    12288:vbNq3U22k24PnuBvJTvfIVcmaBhIaQBanLFHL4UhnPtJHKFm5fto1XGTI:zI24PuvJTEYHLzhnPwU1cL

  Score

  10^/10

  ammyyadminsmokeloaderbackdoorbootkitcollectionevasionpersistencerattrojanflawedammyy

  • Ammyy Admin

    Remote admin tool with various capabilities.

    ratammyyadmin

  • AmmyyAdmin payload

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

    trojanflawedammyy

  • Modifies security service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2