ammyyadmin | ff17decde175542855e8ba56eb8058f180ef6f7696231bf7623906ffb264d619

General

Target

ff17decde175542855e8ba56eb8058f180ef6f7696231bf7623906ffb264d619
Size

2.5MB
Sample

231026-dzzg9aca39
MD5

7578811db1dc86e9298cad006320a938
SHA1

42e8584d1d13fdab51fb8f9d05335f4a52ff97ad
SHA256

ff17decde175542855e8ba56eb8058f180ef6f7696231bf7623906ffb264d619
SHA512

5263f7335bf8388f1b6c28c2e143c5c56e78c3cdd297dde943489ce909b6faf923d5603a898b1927301e1265ffff9f3a62b61cbdaeaa47d492e41bf36d78a11b
SSDEEP

49152:PJo/il+XOWqWhpXIoGtCGs7avcKgiQW0BepMk4Vm5o:PJbm1GL4Gs7McKgiQBepll

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://servermlogs27.xyz/statweb255/

http://servmblog45.xyz/statweb255/

http://demblog575.xyz/statweb255/

http://admlogs85x.xyz/statweb255/

http://blogmstat389.xyz/statweb255/

http://blogmstat255.xyz/statweb255/

rc4.i32

Targets

- Target
  
  ff17decde175542855e8ba56eb8058f180ef6f7696231bf7623906ffb264d619
- Size
  
  2.5MB
- MD5
  
  7578811db1dc86e9298cad006320a938
- SHA1
  
  42e8584d1d13fdab51fb8f9d05335f4a52ff97ad
- SHA256
  
  ff17decde175542855e8ba56eb8058f180ef6f7696231bf7623906ffb264d619
- SHA512
  
  5263f7335bf8388f1b6c28c2e143c5c56e78c3cdd297dde943489ce909b6faf923d5603a898b1927301e1265ffff9f3a62b61cbdaeaa47d492e41bf36d78a11b
- SSDEEP
  
  49152:PJo/il+XOWqWhpXIoGtCGs7avcKgiQW0BepMk4Vm5o:PJbm1GL4Gs7McKgiQBepll
Score

10^/10

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection discovery evasion persistence ransomware rat spyware stealer trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Detect rhadamanthys stealer shellcode
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (321) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1