Overview

overview

10

Static

static

10

fcc84b2913...18.exe

windows7-x64

10

fcc84b2913...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcc84b2913606db9ed575affe65591ae_JaffaCakes118

  • Size

    322KB

  • Sample

    240420-pssxnshe5w

  • MD5

    fcc84b2913606db9ed575affe65591ae

  • SHA1

    a6b6c3e28d245df70c307c354eab877e5fb8efd2

  • SHA256

    34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5

  • SHA512

    5e6f9b0040acea1dce8463bd30eb7905de215fd378d112a4d50dd80303539c38e1f516b7512297c215ae77050445785f994a96b7c8ea94a075ea340229b7e0c7

  • SSDEEP

    6144:MtU6T/wE1MFGonDrJU2kY1b94hsmjVTPdgBGE7YpqTFIVo+AxU36WDbl3:aU+/wEKAonDrFyhtTR+YQTL+Axg

Score
10/10
ammyyadminflawedammyyrattrojanupx

Malware Config

Targets

    • Target

      fcc84b2913606db9ed575affe65591ae_JaffaCakes118

    • Size

      322KB

    • MD5

      fcc84b2913606db9ed575affe65591ae

    • SHA1

      a6b6c3e28d245df70c307c354eab877e5fb8efd2

    • SHA256

      34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5

    • SHA512

      5e6f9b0040acea1dce8463bd30eb7905de215fd378d112a4d50dd80303539c38e1f516b7512297c215ae77050445785f994a96b7c8ea94a075ea340229b7e0c7

    • SSDEEP

      6144:MtU6T/wE1MFGonDrJU2kY1b94hsmjVTPdgBGE7YpqTFIVo+AxU36WDbl3:aU+/wEKAonDrFyhtTR+YQTL+Axg

    Score
    10/10
    ammyyadminflawedammyyrattrojanupx

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks