General
-
Target
9cfbe1b6ef9fb385673a6bd800d0c3c8792701186d3904bb8cb19eb8bfd474e5.zip.zip
-
Size
391KB
-
Sample
231107-rkpldsgf9w
-
MD5
ef9f8e031c7e066e93a708ea2cbc6b78
-
SHA1
d8dcb9d0519b3ae31e886c1a9d7b564ec176c1e1
-
SHA256
9e80a1754fad2561154d9b12b9302c1455b1bc5b16ee72e99c401af98d7af327
-
SHA512
cd9e3b7c7380fa03133a45bd50068f50f4df7d9d11459d006107f9c6db32960ef1c4225e117e7e58a56058df7073702364f082c930e73f2fb16219724faf8ce4
-
SSDEEP
6144:p9yuf6ydsNH6vukrX99L2Fi3AEFFL8RtMF6UBjylQ3pO6v2yKpl+Far+f8f3y:TCW2H6WkbGiw0FL8IE8ylYVvhKPuU/y
Malware Config
Targets
-
-
Target
Ammyy Admin .exe
-
Size
746KB
-
MD5
2cbf5657ffd8858a9597f296a60270c2
-
SHA1
b130611c92788337c4f6bb9e9454ff06eb409166
-
SHA256
9b3f4d6a9bae4d7f9cfe45e706db8fe4baef51ae12353941e8b1532b231e6eac
-
SHA512
06339a299c8c9ce55e9b96582e54e0bf9e04f894ceb47c07486adf8b0140c2a01fd0932207aca8112ee0b16ba8711fee9435e37339aafb94f167b5a736ee7d0b
-
SSDEEP
12288:6NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:6XTszE7PTgM0YOgA4RtcbwhsSYFVL
Score10/10-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-