ammyyadmin | 0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b

General

Target

0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b
Size

473KB
Sample

231001-mgcefaaa7t
MD5

f10096360e1ca117a85a7e2e6e00d076
SHA1

d6c2b34c10b1c7d5a86475d3b506088725e893dd
SHA256

0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b
SHA512

dcf89b4748c3ed2f9040d2928987f8d26fd8c1ddbdf9be13f890aa24cdd324c46e6e7b1e8594dddcc0ce1861d4e15bd4a4dfc9928f1a0c3de3b33fe064bc91c9
SSDEEP

12288:AX0VbDhm1jD/EHvjBpdBod8UvL3+R3Hsr6rY04:0KbD4VoPjvdB+7+RrW

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://servermlogs27.xyz/statweb255/

http://servmblog45.xyz/statweb255/

http://demblog575.xyz/statweb255/

http://admlogs85x.xyz/statweb255/

http://blogmstat389.xyz/statweb255/

http://blogmstat255.xyz/statweb255/

rc4.i32

Targets

- Target
  
  0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b
- Size
  
  473KB
- MD5
  
  f10096360e1ca117a85a7e2e6e00d076
- SHA1
  
  d6c2b34c10b1c7d5a86475d3b506088725e893dd
- SHA256
  
  0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b
- SHA512
  
  dcf89b4748c3ed2f9040d2928987f8d26fd8c1ddbdf9be13f890aa24cdd324c46e6e7b1e8594dddcc0ce1861d4e15bd4a4dfc9928f1a0c3de3b33fe064bc91c9
- SSDEEP
  
  12288:AX0VbDhm1jD/EHvjBpdBod8UvL3+R3Hsr6rY04:0KbD4VoPjvdB+7+RrW
Score

10^/10

ammyyadmin phobos smokeloader backdoor collection evasion persistence ransomware rat trojan flawedammyy gurcu stealer
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Detect Gurcu Stealer V3 payload
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (54) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2