ammyyadmin | 04df4d095a36105942be8be5c147948a99581b6f09c4d17c3e69345a4f2905f7

Sharing

Copy URL Twitter E-mail

General

Target
bb63f8372394ec1a4a9a51985d14326e
Size 23.6MB
Sample240308-qt1jkshb2t
SHA256 04df4d095a36105942be8be5c147948a99581b6f09c4d17c3e69345a4f2905f7
MD5 bb63f8372394ec1a4a9a51985d14326e
SHA1 3fb6883687d99d87f6ec190e1e7965e47dbf4950
SHA512 a935d8b1dcc3f689f72c80109efe45b7dc784e21e46fc291bf880cd17388c45501c4099ad84a40cba41afc5afb7e34633a2d44ffd17aac168e9937d8b7a69f4e
SSDEEP 393216:14OnYNAwDDyMTtOQxxuDm4puKT+MWAk4BDmJONvlo3ofrzRUt3f9SNu8q8i:+OYAwjtOVDHTBk4BKi6YTzRfNxTi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  bb63f8372394ec1a4a9a51985d14326e
- Size 23.6MB
- SHA256 04df4d095a36105942be8be5c147948a99581b6f09c4d17c3e69345a4f2905f7
- MD5 bb63f8372394ec1a4a9a51985d14326e
- SHA1 3fb6883687d99d87f6ec190e1e7965e47dbf4950
- SHA512 a935d8b1dcc3f689f72c80109efe45b7dc784e21e46fc291bf880cd17388c45501c4099ad84a40cba41afc5afb7e34633a2d44ffd17aac168e9937d8b7a69f4e
- SSDEEP 393216:14OnYNAwDDyMTtOQxxuDm4puKT+MWAk4BDmJONvlo3ofrzRUt3f9SNu8q8i:+OYAwjtOVDHTBk4BKi6YTzRfNxTi
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
- MD5 20f3184efe7edddfef3325efc25d12a5
- SHA1 8db4c500d73f9525a7e9834df6caea2e70189939
- SHA512 433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
- SSDEEP 192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
- MD5 ea60c7bd5edd6048601729bd31362c16
- SHA1 6e6919d969eb61a141595014395b6c3f44139073
- SHA512 f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
- SSDEEP 48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/advsplash.dll
- Size 5KB
- SHA256 e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82
- MD5 669030d7919ae29999a2fd89aa427202
- SHA1 870bcb7e87bbf423abcbc1c5be80f7e63720a6d8
- SHA512 1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f
- SSDEEP 96:yqNXqwK188CgAtXvZBkjDf0yf9ysrtWp/wol:yAqrg1XvZB6kYtWp/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  PBWS32.DLL
- Size 38KB
- SHA256 8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240
- MD5 410d09e8cd553a560386c5a76f265cf5
- SHA1 30488587ce89e56f21ea9da7d3b172d93decae0f
- SHA512 029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba
- SSDEEP 768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  baro.exe
- Size 7.0MB
- SHA256 262abffe0208dab0a99070a7eebff93134955b53cabb4695702145124f5b7aae
- MD5 4db6e4dbc3facbd900909bd2af451f01
- SHA1 850a79df522fceb40b225207df1dd3f77bd0f034
- SHA512 22122c066bb0f72bbd4bce485edbbbbf6ed8a9e1391a1c37b296a81efba3ae235070ca63d375f46d83c2c9a333eab4663d828b857217fd07c182234e2b7b9f4c
- SSDEEP 98304:Xcr+6UvQxJOx2woktY2S185DCq3F+PyowmWhuc4NbRv6/d:Mr+6UoxJOx2dqS1gDLV+PzwmhNg/d
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  dll/FreeImage.dll
- Size 3.2MB
- SHA256 242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323
- MD5 2513b9e999605cf8c42a8aa96837feae
- SHA1 76dde6500a044ba14547a648939ac11b1eaecc73
- SHA512 0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6
- SSDEEP 24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  dll/Interop.WIA.dll
- Size 44KB
- SHA256 a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0
- MD5 858dd3d914c467b8c2326f015d927aca
- SHA1 48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7
- SHA512 cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6
- SSDEEP 768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  dll/MarkupConverter.dll
- Size 79KB
- SHA256 1f269d459ad472274bc9c83762027fe77444f1d429f914adade77ffc869d3f47
- MD5 e42dead11301b7bdd39ffaa08942e8ff
- SHA1 986fe2d1bf0e6b69a1966e8657648f41fc24dff3
- SHA512 eaaae18441ae8b25bb6793af74e1febbbb8b0e398c724106652544f4ab28b3602c58d6a584ebc396ccbcc7d43f259d8ac47146aa18b1046f8e0d365234c23e2e
- SSDEEP 1536:AAK778X2zLoMa6Un8y7b3hmkcecwNjpW5loU5TJYVEnofviwuPnNrXLP2zrmH1nU:Q778XULoMa69Yb34lecQwr4rmH1nG2nU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  dll/PdfSharp.dll
- Size 568KB
- SHA256 6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176
- MD5 f9a4afed4a99e87450a359c3988c43d0
- SHA1 2a9082ca8b5276cb080c566277370680d48f78e7
- SHA512 b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600
- SSDEEP 12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  dll/RegAsm.exe
- Size 52KB
- SHA256 9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36
- MD5 4b63f5e28d8e2ed769cd900bf0709c22
- SHA1 8cdb6b0f735adf9ccf5cabd96df56edff72b287d
- SHA512 cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22
- SSDEEP 768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  dll/SDD_TWAIN_SCANNER.dll
- Size 28KB
- SHA256 55a21f5fdfc483da77b0c6d59d4c982fbd21c51a2cc7c7349957c9908e96b849
- MD5 8a500063779f16db39778cce1c986290
- SHA1 719df82535101c10e5b4b73cd35fb23b717ab079
- SHA512 d0605deabe6b1f7745b28a6e79a6daa7c32ad6c7f79997352bdd2417d8dd698fe063d193d46026251f7f9cdba45090afb639618601c74db9694b599f4af2b651
- SSDEEP 384:2Mi7JRsrGCJ7TutP8XMZu1VsGUU4kaf65DC/EIL4xZ0CsKhScl6IyzRM9xOSrFcu:fJ7TrXeUV9UU4vREIkoD5ACPoUxG9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  dll/Saraff.Twain.dll
- Size 52KB
- SHA256 2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a
- MD5 dfd91064c061ee5a3245c936daee1d6a
- SHA1 29db79f7b45611d769467f4e063ef00feebe5073
- SHA512 e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448
- SSDEEP 1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  dll/System.Drawing.dll
- Size 616KB
- SHA256 7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643
- MD5 3716fb11c20e313d2deb35e9a73a05f6
- SHA1 a26cecb78abc8f45913968bcd864a18f26ff165f
- SHA512 f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7
- SSDEEP 6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  dll/UzakYardim.exe
- Size 740KB
- SHA256 55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
- MD5 10a524d7ac94678ae286b065421647db
- SHA1 b538e3f113817c8237419310ef47817d1d961fa9
- SHA512 928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
- SSDEEP 12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

flawedammyy trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  dll/WinSCP.com
- Size 277KB
- SHA256 24e98f04948e730121af8c6f186b8b288a66bfdf88dcf4d11b7ef2878463bd89
- MD5 50c182293fef31782db383b5f5fb5a3f
- SHA1 f884abacee9918bd3d454e531638aa16219d3f2b
- SHA512 0399940f9661cbc156395700a0c3a5e6d69d02f7cb9bc43c7437cdcc4106e4e3a813ebd615e016e842b0ed93b14435f9134cd0d61a985b840fe922db65e6ba62
- SSDEEP 6144:skdBy6tHmG676IS8i5cSXX6a8sg4iAA+KVI:By6tHe76IS8i5LXviAAje
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

FlawedAmmyy RAT

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Enumerates connected drives

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32