Overview

overview

10

Static

static

10

3aafebbf15...18.exe

windows7-x64

10

3aafebbf15...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3aafebbf1591363029b868c1b664b808_JaffaCakes118

  • Size

    735KB

  • Sample

    240512-saavxsbc5z

  • MD5

    3aafebbf1591363029b868c1b664b808

  • SHA1

    7f213071dd178ec31afe1c8a443f817fce50b233

  • SHA256

    553d2f7a372c37f11870bcfc9cd923037b45ac97a130697064549f48e81ac29e

  • SHA512

    8fcd5bacbdc5aed3c48420fcbd3ea5a4a8a0a5c81ab043addbd8b2e559f8a9580b6bbdd513273d6075f69f04f52f6d413941095895c9a06677e61e0ab201b596

  • SSDEEP

    12288:7c0dZib4t9uOroAgUHvCUt4RtlTc+YNKpQsNvVd6gr:7c/UtwOrZgUHv54Rt6+YNkQsNnr

Score
10/10
ammyyadminflawedammyytrojan

Malware Config

Targets

    • Target

      3aafebbf1591363029b868c1b664b808_JaffaCakes118

    • Size

      735KB

    • MD5

      3aafebbf1591363029b868c1b664b808

    • SHA1

      7f213071dd178ec31afe1c8a443f817fce50b233

    • SHA256

      553d2f7a372c37f11870bcfc9cd923037b45ac97a130697064549f48e81ac29e

    • SHA512

      8fcd5bacbdc5aed3c48420fcbd3ea5a4a8a0a5c81ab043addbd8b2e559f8a9580b6bbdd513273d6075f69f04f52f6d413941095895c9a06677e61e0ab201b596

    • SSDEEP

      12288:7c0dZib4t9uOroAgUHvCUt4RtlTc+YNKpQsNvVd6gr:7c/UtwOrZgUHv54Rt6+YNkQsNnr

    Score
    10/10
    flawedammyytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks