Overview

overview

10

Static

static

10

3a37860ff8...18.exe

windows7-x64

10

3a37860ff8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118

  • Size

    993KB

  • Sample

    240512-p46ynsaf46

  • MD5

    3a37860ff81fc1f7a9618757bbbcc9e4

  • SHA1

    16abe227b3cc35847fb0caffa6536d13bcafe41d

  • SHA256

    3626f2ec2137a5c30479baa33ec81e4eb1b3d018baf59200547e742b8b4a76e2

  • SHA512

    5a1efe72274501492c761af0b998562adc6e08fe866a992dda6e026f336175fa160c4753535a65d975546553f99a6b07137eee66163ac9dadfa64a06de0c214e

  • SSDEEP

    24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxX:dJ5gEKNikf3hBfUiWxX

Score
10/10
ammyyadminrat

Malware Config

Targets

    • Target

      3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118

    • Size

      993KB

    • MD5

      3a37860ff81fc1f7a9618757bbbcc9e4

    • SHA1

      16abe227b3cc35847fb0caffa6536d13bcafe41d

    • SHA256

      3626f2ec2137a5c30479baa33ec81e4eb1b3d018baf59200547e742b8b4a76e2

    • SHA512

      5a1efe72274501492c761af0b998562adc6e08fe866a992dda6e026f336175fa160c4753535a65d975546553f99a6b07137eee66163ac9dadfa64a06de0c214e

    • SSDEEP

      24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxX:dJ5gEKNikf3hBfUiWxX

    Score
    10/10
    ammyyadminrat

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks