General
-
Target
6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe.zip
-
Size
402KB
-
Sample
231031-rfq9esbd94
-
MD5
bad67bff9f7012457048104b419c1505
-
SHA1
912419662619c87c76371e5847ff4224d97a5997
-
SHA256
a0f4da42bc836acaa6260abbe06c79808a169545344a90f0d3d15e113b70f0ed
-
SHA512
ea9d211227126b93d070992f6d7c9c717e2571d059cb8a8762d2f6527b6e3a29f4dcae7dc5ab24833bc72ccc362a0e1bd2aaff514e7b7c0c9dfeeae777581063
-
SSDEEP
6144:B4oeOoWAV3dWdJRnv+pCzgjFel1Bg5m9aAqaMoudSiCpN16rE0AXT3ISnTEXf0:Wx33dW7RIu2FMOm9aA6oMcN1MVAXxn
Behavioral task
behavioral1
Sample
6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Resource
win10v2004-20231020-en
Malware Config
Targets
-
-
Target
6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
-
Size
746KB
-
MD5
f8cd52b70a11a1fb3f29c6f89ff971ec
-
SHA1
6a0c46818a6a10c2c5a98a0cce65fbaf95caa344
-
SHA256
6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
-
SHA512
987b6b288a454b6198d4e7f94b7bba67cafe37f9654cd3cd72134a85958efd2125596ae48e66a8ee49ee3f4199dac7f136e1831f2bf4015f25d2980f0b866abe
-
SSDEEP
12288:PUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjcP6gX:zpJJWOwlaUPcWWwRZb4Rt+N5WMasHoX
Score10/10-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-