ammyyadmin | 198f70a8827b1e9114dcd0c14191d495e52cd38393a1d603c62fc1ae7c48e3b2 | Triage

Submit
Reports

Overview

overview

Static

static

b477304957...cs.exe

windows7-x64

b477304957...cs.exe

windows10-2004-x64

Sharing

General

Target

b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics
Size

713KB
Sample

240513-napxmacf78
MD5

b47730495747868c2fa6f4ff3e94b7b0
SHA1

f8f1b33ed6231d01aae10ed8c89f31d11f38f06e
SHA256

198f70a8827b1e9114dcd0c14191d495e52cd38393a1d603c62fc1ae7c48e3b2
SHA512

91b2d33ca82d94084300d51fa206ab68e6ee1b94b779df8cce7c4fdf176c7037914566f3e53e7e7abbae44c7146dfbfcc3a9493d45a47a84e55325dd61d3c652
SSDEEP

12288:UVr29UGEg6VUM5oAL1jq3E2jj0NOjAqHKtCessZWjya7VM1en9Nm1RtNeCVao2Vp:uUbj4qwCessA41Rt0CVMVZtxP

Score

10^/10

ammyyadmin flawedammyy rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe

Resource

win7-20240419-en

ammyyadmin flawedammyy rat trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe

Resource

win10v2004-20240508-en

ammyyadmin flawedammyy rat trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics
- Size
  
  713KB
- MD5
  
  b47730495747868c2fa6f4ff3e94b7b0
- SHA1
  
  f8f1b33ed6231d01aae10ed8c89f31d11f38f06e
- SHA256
  
  198f70a8827b1e9114dcd0c14191d495e52cd38393a1d603c62fc1ae7c48e3b2
- SHA512
  
  91b2d33ca82d94084300d51fa206ab68e6ee1b94b779df8cce7c4fdf176c7037914566f3e53e7e7abbae44c7146dfbfcc3a9493d45a47a84e55325dd61d3c652
- SSDEEP
  
  12288:UVr29UGEg6VUM5oAL1jq3E2jj0NOjAqHKtCessZWjya7VM1en9Nm1RtNeCVao2Vp:uUbj4qwCessA41Rt0CVMVZtxP
Score

10^/10

ammyyadmin flawedammyy rat trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ammyyadminflawedammyyrattrojan

behavioral2

ammyyadminflawedammyyrattrojan

© 2018-2024

Terms | Privacy