ammyyadmin | 51112c067bd5c87a44698ec80bf9873160eee16b2d7c9775786e41724a06ecd7

Sharing

Copy URL

Twitter E-mail

General

Target

4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118
Size

17.6MB
Sample

240715-x1s7eaxhnd
MD5

4b0e190b8bc86042666a041fe7ce5fa0
SHA1

6f81a0b91529659982a4ac5a6d507b53f671b438
SHA256

51112c067bd5c87a44698ec80bf9873160eee16b2d7c9775786e41724a06ecd7
SHA512

f89ba14f8b74c6dc82b6bcfeac57d182374a78921f29dca531de5e0bca4b2ac9eea9b4885b4ddf5cd2308319e07a333a41f3c54e8e8f9e7d7e86139858143d52
SSDEEP

393216:p8q4MTSXPXpoRiwDDymzSo6NK6ZR/tbspb16ltRmJONTshFHo6r3ELG7t:pRmXPXpoMwavN7RlbsetsiT25TdB

Score

10^/10

Malware Config

Targets

- Target
  
  4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118
- Size
  
  17.6MB
- MD5
  
  4b0e190b8bc86042666a041fe7ce5fa0
- SHA1
  
  6f81a0b91529659982a4ac5a6d507b53f671b438
- SHA256
  
  51112c067bd5c87a44698ec80bf9873160eee16b2d7c9775786e41724a06ecd7
- SHA512
  
  f89ba14f8b74c6dc82b6bcfeac57d182374a78921f29dca531de5e0bca4b2ac9eea9b4885b4ddf5cd2308319e07a333a41f3c54e8e8f9e7d7e86139858143d52
- SSDEEP
  
  393216:p8q4MTSXPXpoRiwDDymzSo6NK6ZR/tbspb16ltRmJONTshFHo6r3ELG7t:pRmXPXpoMwavN7RlbsetsiT25TdB
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  20f3184efe7edddfef3325efc25d12a5
- SHA1
  
  8db4c500d73f9525a7e9834df6caea2e70189939
- SHA256
  
  0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
- SHA512
  
  433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
- SSDEEP
  
  192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  ea60c7bd5edd6048601729bd31362c16
- SHA1
  
  6e6919d969eb61a141595014395b6c3f44139073
- SHA256
  
  4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
- SHA512
  
  f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
- SSDEEP
  
  48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/advsplash.dll
- Size
  
  5KB
- MD5
  
  669030d7919ae29999a2fd89aa427202
- SHA1
  
  870bcb7e87bbf423abcbc1c5be80f7e63720a6d8
- SHA256
  
  e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82
- SHA512
  
  1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f
- SSDEEP
  
  96:yqNXqwK188CgAtXvZBkjDf0yf9ysrtWp/wol:yAqrg1XvZB6kYtWp/
Score

3^/10
behavioral7 behavioral8
- Target
  
  PBWS32.DLL
- Size
  
  38KB
- MD5
  
  410d09e8cd553a560386c5a76f265cf5
- SHA1
  
  30488587ce89e56f21ea9da7d3b172d93decae0f
- SHA256
  
  8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240
- SHA512
  
  029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba
- SSDEEP
  
  768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw
Score

3^/10
behavioral10 behavioral9
- Target
  
  baro.exe
- Size
  
  6.2MB
- MD5
  
  0d6db42ff128a9e607194a7c549fc8bd
- SHA1
  
  93825791ca803e3ac9c31508f3a1458281735be6
- SHA256
  
  4f6169f3a64bc32b0cb83e2c85945e82986b86a9c2d0f8fe2915735c6b3d52d5
- SHA512
  
  994bf2592f4e67abaf338cba659d713de6417b06d49b55024e02b8294f2c767f758f0ff94d1767cf13ee5249b658a177b7be39ad56c356c58d7cda42859e838e
- SSDEEP
  
  49152:XAxE7wzvK6cuS157JhDmwDk04lUbWDq9XLThPbocjfvQBSTTRP8wmEq4q4awSyQ/:Xc7K6OrJThPb1zqSlcmfE
Score

1^/10
behavioral11 behavioral12
- Target
  
  dll/FreeImage.dll
- Size
  
  3.2MB
- MD5
  
  2513b9e999605cf8c42a8aa96837feae
- SHA1
  
  76dde6500a044ba14547a648939ac11b1eaecc73
- SHA256
  
  242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323
- SHA512
  
  0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6
- SSDEEP
  
  24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF
Score

3^/10
behavioral13 behavioral14
- Target
  
  dll/Interop.WIA.dll
- Size
  
  44KB
- MD5
  
  858dd3d914c467b8c2326f015d927aca
- SHA1
  
  48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7
- SHA256
  
  a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0
- SHA512
  
  cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6
- SSDEEP
  
  768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE
Score

1^/10
behavioral15 behavioral16
- Target
  
  dll/PdfSharp.dll
- Size
  
  568KB
- MD5
  
  f9a4afed4a99e87450a359c3988c43d0
- SHA1
  
  2a9082ca8b5276cb080c566277370680d48f78e7
- SHA256
  
  6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176
- SHA512
  
  b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600
- SSDEEP
  
  12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG
Score

1^/10
behavioral17 behavioral18
- Target
  
  dll/RegAsm.exe
- Size
  
  52KB
- MD5
  
  4b63f5e28d8e2ed769cd900bf0709c22
- SHA1
  
  8cdb6b0f735adf9ccf5cabd96df56edff72b287d
- SHA256
  
  9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36
- SHA512
  
  cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22
- SSDEEP
  
  768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j
Score

1^/10
behavioral19 behavioral20
- Target
  
  dll/SDD_TWAIN_SCANNER.dll
- Size
  
  22KB
- MD5
  
  95169eb3b1f580f7b75b74709648aab0
- SHA1
  
  ab4dae1b43c3d1350112ae6413af83997a4c5f0e
- SHA256
  
  d124c1827fcb11f398d1933a2619d6a7ce5c4344ff7fb9f9a4949ebfd9a33ece
- SHA512
  
  8b9dce4d6e21f58f0ab62cbae260387be56ca95760390210595d6646465fbf94eb1854c9513c7ea040d15208cd953d38a2e1b33dc399a0a85826672c132613fb
- SSDEEP
  
  384:GsMi7JRo7cYVW9b7L0DRIoO63l8BiPy2RM9HlGF4gKoeAWq:ANVkvL0DRIoO6eOA+Kosq
Score

1^/10
behavioral21 behavioral22
- Target
  
  dll/Saraff.Twain.dll
- Size
  
  52KB
- MD5
  
  dfd91064c061ee5a3245c936daee1d6a
- SHA1
  
  29db79f7b45611d769467f4e063ef00feebe5073
- SHA256
  
  2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a
- SHA512
  
  e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448
- SSDEEP
  
  1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19
Score

1^/10
behavioral23 behavioral24
- Target
  
  dll/System.Drawing.dll
- Size
  
  616KB
- MD5
  
  3716fb11c20e313d2deb35e9a73a05f6
- SHA1
  
  a26cecb78abc8f45913968bcd864a18f26ff165f
- SHA256
  
  7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643
- SHA512
  
  f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7
- SSDEEP
  
  6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9
Score

1^/10
behavioral25 behavioral26
- Target
  
  dll/UzakYardim.exe
- Size
  
  740KB
- MD5
  
  10a524d7ac94678ae286b065421647db
- SHA1
  
  b538e3f113817c8237419310ef47817d1d961fa9
- SHA256
  
  55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
- SHA512
  
  928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
- SSDEEP
  
  12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy
Score

10^/10

flawedammyy trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  
  dll/WinSCP.com
- Size
  
  286KB
- MD5
  
  0317031c87b6626dffba1ee7572767d1
- SHA1
  
  9fe90dbb9a65f87c48bd0448c786666b6577906e
- SHA256
  
  83fab3dcef92514cf1f41ac458fb8b7dc5a93ac08cbf2d55d1c5989c66a27707
- SHA512
  
  51125d3cbefc61c87949df26836da60f6716b9f36df1bfa56af63f1f7e20b386b60a0587233c56d05fc66eb206dbab46098dc4c3ad1681e622a7949b145f95c5
- SSDEEP
  
  6144:SeoDiHHL7SIZaHBQuN67mUWyQsJwFqwckA/H9No:S5USIZahBN67mUW3AIA/c
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  
  dll/WinSCP.exe
- Size
  
  9.7MB
- MD5
  
  970f87e2a609b122a20667b5376a4847
- SHA1
  
  4231757664a14a38ebbc4403f5c75230301f3db1
- SHA256
  
  db21dfaf2a143fcb48d98456ecb215d67f6484961c94244741d88569c033f410
- SHA512
  
  93a9900ba13fd8f5f87b5d0d3fba535c9fbaec1b73c8db831bb2dd02050438b960393f8cb0cbffefb582071f919dc3501bdd73fe1df33f36acf3322e23be28e9
- SSDEEP
  
  196608:qsGchj5i2yHc+3D5a11Gv/8LBZHNa+Ra91Ojyft2SKdunyXvA8T28jGRI7i8Pw6E:q6TkJp4MKF8pqPrcH96+8ox7n9
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

FlawedAmmyy RAT

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32