Overview

overview

10

Static

static

10

c0b351255c...6d.exe

windows7-x64

10

c0b351255c...6d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0b351255c840115a53ed773740755870f08253fbd6d4ee104a0cda045cf206d

  • Size

    955KB

  • Sample

    240904-ncvwnazgjd

  • MD5

    6b612287fc44bcfbd0d2ae9ccd994c95

  • SHA1

    b645a4590c175599f122e2546aa2998a3e9dfd58

  • SHA256

    c0b351255c840115a53ed773740755870f08253fbd6d4ee104a0cda045cf206d

  • SHA512

    b7737fd2de2e14f47393a3bc89bc1677cad10e4a19f5c3513b8fec05b3b85cb802da7059f97f6b34e819d20be034c51edbc8dc5c08f0a1ccee4b2ffc861b5871

  • SSDEEP

    24576:rMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxi:mJ5gEKNikf3hBfUiWxi

Score
10/10
ammyyadmindiscoveryratupx

Malware Config

Targets

    • Target

      c0b351255c840115a53ed773740755870f08253fbd6d4ee104a0cda045cf206d

    • Size

      955KB

    • MD5

      6b612287fc44bcfbd0d2ae9ccd994c95

    • SHA1

      b645a4590c175599f122e2546aa2998a3e9dfd58

    • SHA256

      c0b351255c840115a53ed773740755870f08253fbd6d4ee104a0cda045cf206d

    • SHA512

      b7737fd2de2e14f47393a3bc89bc1677cad10e4a19f5c3513b8fec05b3b85cb802da7059f97f6b34e819d20be034c51edbc8dc5c08f0a1ccee4b2ffc861b5871

    • SSDEEP

      24576:rMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxi:mJ5gEKNikf3hBfUiWxi

    Score
    10/10
    ammyyadmindiscoveryratupx

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks