Overview

overview

10

Static

static

10

d67c7ef1c8...05.exe

windows7-x64

10

d67c7ef1c8...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605.exe.zip

  • Size

    408KB

  • Sample

    231201-sfsmxsah71

  • MD5

    9d806beecd97d51647dd8b553b7b8dd6

  • SHA1

    6be07bc2369f116281aecd04508cc3257606e180

  • SHA256

    480db250da8cbb3234c64ce8d30e119addb3f2e515332a1da113d9e7b12142fd

  • SHA512

    7abe44358afd757c69ea81d1f5bff59b88f4bfc0bba8869dfd1c3ac7754e9173868d93d4a1ce3be45d3812b28347064b5dc411dd2b4c9e1dbd046701ff7dabb4

  • SSDEEP

    12288:d+dt5kNk5ySmHdp/OVr6D7pFwabk0bnXQ:0tJzm9cVMUv0bXQ

Score
10/10
ammyyadminflawedammyytrojan

Malware Config

Targets

    • Target

      d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605.exe

    • Size

      762KB

    • MD5

      e9b569f7cbf23d91df065c18f4c43840

    • SHA1

      5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad

    • SHA256

      d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605

    • SHA512

      a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb

    • SSDEEP

      12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte

    Score
    10/10
    flawedammyytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks