ammyyadmin | 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a | Triage

Sharing

General

Target

349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a
Size

722KB
Sample

240112-299b7sgde5
MD5

45c9b54d66cbcc2de89f93e25f368a45
SHA1

2e5265f35f75a50c89e592e127bc80e1e45aa840
SHA256

349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a
SHA512

25c3f1ec6d2e233464090f584777b15f18acfd1cb12124c236680689545ec8208bc364d26d7202e38368dbec34cd824600afb51845df8c9de8c8e83fba8d8b1f
SSDEEP

12288:x2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hEgK:xSIp2Ydd6SVcpz1RtXpGadsbShK

Score

10^/10

ammyyadmin flawedammyy trojan

Malware Config

Targets

- Target
  
  349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a
- Size
  
  722KB
- MD5
  
  45c9b54d66cbcc2de89f93e25f368a45
- SHA1
  
  2e5265f35f75a50c89e592e127bc80e1e45aa840
- SHA256
  
  349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a
- SHA512
  
  25c3f1ec6d2e233464090f584777b15f18acfd1cb12124c236680689545ec8208bc364d26d7202e38368dbec34cd824600afb51845df8c9de8c8e83fba8d8b1f
- SSDEEP
  
  12288:x2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hEgK:xSIp2Ydd6SVcpz1RtXpGadsbShK
Score

10^/10

flawedammyy trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

flawedammyytrojan

behavioral2

flawedammyytrojan