Overview

overview

10

Static

static

10

4384015f0e...18.exe

windows7-x64

10

4384015f0e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4384015f0e7a2c6e3738fc2492cc1075_JaffaCakes118

  • Size

    746KB

  • Sample

    240514-291easdd3x

  • MD5

    4384015f0e7a2c6e3738fc2492cc1075

  • SHA1

    0dfa27fc3204ebfa172cd1eb97f798914b006140

  • SHA256

    daaed52990a467051c10ef429b4b4546833ac831ceb1e14e15d3a9d9e1e775ab

  • SHA512

    7131c88d0987142e66d9b7247902e18e7951896998a66f725515f8d8b8b4e24ccffe73b457ccf34dd764297b14cd095e19e0af79cacc5b67c7e4f1ac733b27dd

  • SSDEEP

    12288:8NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:8XTszE7PTgM0YOgA4RtcbwhsSYFVL

Score
10/10
ammyyadminflawedammyyrattrojan

Malware Config

Targets

    • Target

      4384015f0e7a2c6e3738fc2492cc1075_JaffaCakes118

    • Size

      746KB

    • MD5

      4384015f0e7a2c6e3738fc2492cc1075

    • SHA1

      0dfa27fc3204ebfa172cd1eb97f798914b006140

    • SHA256

      daaed52990a467051c10ef429b4b4546833ac831ceb1e14e15d3a9d9e1e775ab

    • SHA512

      7131c88d0987142e66d9b7247902e18e7951896998a66f725515f8d8b8b4e24ccffe73b457ccf34dd764297b14cd095e19e0af79cacc5b67c7e4f1ac733b27dd

    • SSDEEP

      12288:8NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:8XTszE7PTgM0YOgA4RtcbwhsSYFVL

    Score
    10/10
    ammyyadminflawedammyyrattrojan

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks