ammyyadmin | 68fc88238de071fbdc5f7e1c9771adec1bca2903752f148e6cdb7ea6e796a966

Sharing

Copy URL

Twitter E-mail

General

Target

7086b71e012a95a8cacea869c0faa921_JaffaCakes118
Size

17.2MB
Sample

240525-chr66sba93
MD5

7086b71e012a95a8cacea869c0faa921
SHA1

2359385afa3812dd681356d301762dd7a90d5749
SHA256

68fc88238de071fbdc5f7e1c9771adec1bca2903752f148e6cdb7ea6e796a966
SHA512

a2a2d0a01d51ccc0b86516c79b1552f06557dfda88f006746851d8bbea44cf908b981521bc2704e4f472da08e34c555d32bc75f0263ba9e24ed908ef83c1c045
SSDEEP

393216:aU8E0Q81jC2OwDDyTHpslrduchoFs/TZ+LmJONTshFHo6r3ELG7O:aUcmrwWWlrkal+yiT25TdK

Score

10^/10

Malware Config

Targets

- Target
  
  7086b71e012a95a8cacea869c0faa921_JaffaCakes118
- Size
  
  17.2MB
- MD5
  
  7086b71e012a95a8cacea869c0faa921
- SHA1
  
  2359385afa3812dd681356d301762dd7a90d5749
- SHA256
  
  68fc88238de071fbdc5f7e1c9771adec1bca2903752f148e6cdb7ea6e796a966
- SHA512
  
  a2a2d0a01d51ccc0b86516c79b1552f06557dfda88f006746851d8bbea44cf908b981521bc2704e4f472da08e34c555d32bc75f0263ba9e24ed908ef83c1c045
- SSDEEP
  
  393216:aU8E0Q81jC2OwDDyTHpslrduchoFs/TZ+LmJONTshFHo6r3ELG7O:aUcmrwWWlrkal+yiT25TdK
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/AdvSplash.dll
- Size
  
  6KB
- MD5
  
  13cc92f90a299f5b2b2f795d0d2e47dc
- SHA1
  
  aa69ead8520876d232c6ed96021a4825e79f542f
- SHA256
  
  eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
- SHA512
  
  ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
- SSDEEP
  
  96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  9384f4007c492d4fa040924f31c00166
- SHA1
  
  aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA256
  
  60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- SHA512
  
  68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP
  
  48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
Score

3^/10
behavioral7 behavioral8
- Target
  
  PBWS32.DLL
- Size
  
  38KB
- MD5
  
  410d09e8cd553a560386c5a76f265cf5
- SHA1
  
  30488587ce89e56f21ea9da7d3b172d93decae0f
- SHA256
  
  8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240
- SHA512
  
  029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba
- SSDEEP
  
  768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw
Score

3^/10
behavioral10 behavioral9
- Target
  
  baro.exe
- Size
  
  5.5MB
- MD5
  
  2a9ac5f0064411558c54ecf0a4b6dbe6
- SHA1
  
  5f6caa42310484eb244ebb59478667b4f60d65da
- SHA256
  
  61301a3f53beda5ca5755a2d4829ef3c6567af1dc68b961cde0a961321e18e41
- SHA512
  
  e1f0937c45072d6f2064d9751ea95e9e4f4b98787720e57cad94dafae02a78262860ee95f4e1244c70029ee75d4584d97996e5b9a2ac4936baade6aa8342c899
- SSDEEP
  
  24576:XL8xxqkqydbgiSK4Fq1LpojPcZOfM/swssTzLy2LjpFIfQx6R4LOoO78FaIxmqvi:XAxE7wb1SK4FspZOfE5I88osq2Ix4Ln
Score

1^/10
behavioral11 behavioral12
- Target
  
  dll/FreeImage.dll
- Size
  
  3.2MB
- MD5
  
  2513b9e999605cf8c42a8aa96837feae
- SHA1
  
  76dde6500a044ba14547a648939ac11b1eaecc73
- SHA256
  
  242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323
- SHA512
  
  0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6
- SSDEEP
  
  24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF
Score

3^/10
behavioral13 behavioral14
- Target
  
  dll/Interop.WIA.dll
- Size
  
  44KB
- MD5
  
  858dd3d914c467b8c2326f015d927aca
- SHA1
  
  48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7
- SHA256
  
  a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0
- SHA512
  
  cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6
- SSDEEP
  
  768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE
Score

1^/10
behavioral15 behavioral16
- Target
  
  dll/PdfSharp.dll
- Size
  
  568KB
- MD5
  
  f9a4afed4a99e87450a359c3988c43d0
- SHA1
  
  2a9082ca8b5276cb080c566277370680d48f78e7
- SHA256
  
  6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176
- SHA512
  
  b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600
- SSDEEP
  
  12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG
Score

1^/10
behavioral17 behavioral18
- Target
  
  dll/RegAsm.exe
- Size
  
  52KB
- MD5
  
  4b63f5e28d8e2ed769cd900bf0709c22
- SHA1
  
  8cdb6b0f735adf9ccf5cabd96df56edff72b287d
- SHA256
  
  9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36
- SHA512
  
  cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22
- SSDEEP
  
  768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j
Score

1^/10
behavioral19 behavioral20
- Target
  
  dll/SDD_TWAIN_SCANNER.dll
- Size
  
  22KB
- MD5
  
  95169eb3b1f580f7b75b74709648aab0
- SHA1
  
  ab4dae1b43c3d1350112ae6413af83997a4c5f0e
- SHA256
  
  d124c1827fcb11f398d1933a2619d6a7ce5c4344ff7fb9f9a4949ebfd9a33ece
- SHA512
  
  8b9dce4d6e21f58f0ab62cbae260387be56ca95760390210595d6646465fbf94eb1854c9513c7ea040d15208cd953d38a2e1b33dc399a0a85826672c132613fb
- SSDEEP
  
  384:GsMi7JRo7cYVW9b7L0DRIoO63l8BiPy2RM9HlGF4gKoeAWq:ANVkvL0DRIoO6eOA+Kosq
Score

1^/10
behavioral21 behavioral22
- Target
  
  dll/Saraff.Twain.dll
- Size
  
  52KB
- MD5
  
  dfd91064c061ee5a3245c936daee1d6a
- SHA1
  
  29db79f7b45611d769467f4e063ef00feebe5073
- SHA256
  
  2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a
- SHA512
  
  e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448
- SSDEEP
  
  1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19
Score

1^/10
behavioral23 behavioral24
- Target
  
  dll/System.Drawing.dll
- Size
  
  616KB
- MD5
  
  3716fb11c20e313d2deb35e9a73a05f6
- SHA1
  
  a26cecb78abc8f45913968bcd864a18f26ff165f
- SHA256
  
  7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643
- SHA512
  
  f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7
- SSDEEP
  
  6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9
Score

1^/10
behavioral25 behavioral26
- Target
  
  dll/UzakYardim.exe
- Size
  
  740KB
- MD5
  
  10a524d7ac94678ae286b065421647db
- SHA1
  
  b538e3f113817c8237419310ef47817d1d961fa9
- SHA256
  
  55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
- SHA512
  
  928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
- SSDEEP
  
  12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy
Score

10^/10

flawedammyy trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  
  dll/WinSCP.com
- Size
  
  286KB
- MD5
  
  0317031c87b6626dffba1ee7572767d1
- SHA1
  
  9fe90dbb9a65f87c48bd0448c786666b6577906e
- SHA256
  
  83fab3dcef92514cf1f41ac458fb8b7dc5a93ac08cbf2d55d1c5989c66a27707
- SHA512
  
  51125d3cbefc61c87949df26836da60f6716b9f36df1bfa56af63f1f7e20b386b60a0587233c56d05fc66eb206dbab46098dc4c3ad1681e622a7949b145f95c5
- SSDEEP
  
  6144:SeoDiHHL7SIZaHBQuN67mUWyQsJwFqwckA/H9No:S5USIZahBN67mUW3AIA/c
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  
  dll/WinSCP.exe
- Size
  
  9.7MB
- MD5
  
  970f87e2a609b122a20667b5376a4847
- SHA1
  
  4231757664a14a38ebbc4403f5c75230301f3db1
- SHA256
  
  db21dfaf2a143fcb48d98456ecb215d67f6484961c94244741d88569c033f410
- SHA512
  
  93a9900ba13fd8f5f87b5d0d3fba535c9fbaec1b73c8db831bb2dd02050438b960393f8cb0cbffefb582071f919dc3501bdd73fe1df33f36acf3322e23be28e9
- SSDEEP
  
  196608:qsGchj5i2yHc+3D5a11Gv/8LBZHNa+Ra91Ojyft2SKdunyXvA8T28jGRI7i8Pw6E:q6TkJp4MKF8pqPrcH96+8ox7n9
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

FlawedAmmyy RAT

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32