Overview

overview

10

Static

static

3

876ef346ef...18.exe

windows7-x64

10

876ef346ef...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    876ef346ef6409a1f2171ca9e30b426d_JaffaCakes118

  • Size

    847KB

  • Sample

    240531-sj2d8scb8y

  • MD5

    876ef346ef6409a1f2171ca9e30b426d

  • SHA1

    abe7af4334b569b05a0bd4d58141f3824e956e9d

  • SHA256

    d1d27ef37d842143c8e8bea51ec031d10ba471874173a7d7f495c87ebd351118

  • SHA512

    cef537e149a56778c466d6724e2d7ed61b81a3c1a8302eafe950b37ab3a5e7582f7d9449719948981c98f28a9e198ab638f2dc82a7c12ca7568c6027dd16749d

  • SSDEEP

    12288:g0nyfXuIBDtfu7HbKa/xArOTb1XL9sG9C6DWEsL0EiUs8HHRPqfz:dny/f9upjL9PCzXgpUTPqfz

Score
10/10
ammyyadminflawedammyyevasionexecutionpersistencerattrojan

Malware Config

Targets

    • Target

      876ef346ef6409a1f2171ca9e30b426d_JaffaCakes118

    • Size

      847KB

    • MD5

      876ef346ef6409a1f2171ca9e30b426d

    • SHA1

      abe7af4334b569b05a0bd4d58141f3824e956e9d

    • SHA256

      d1d27ef37d842143c8e8bea51ec031d10ba471874173a7d7f495c87ebd351118

    • SHA512

      cef537e149a56778c466d6724e2d7ed61b81a3c1a8302eafe950b37ab3a5e7582f7d9449719948981c98f28a9e198ab638f2dc82a7c12ca7568c6027dd16749d

    • SSDEEP

      12288:g0nyfXuIBDtfu7HbKa/xArOTb1XL9sG9C6DWEsL0EiUs8HHRPqfz:dny/f9upjL9PCzXgpUTPqfz

    Score
    10/10
    ammyyadminflawedammyyevasionexecutionpersistencerattrojan

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks