ammyyadmin | cee61f99f9b0b9e118ff49d8405ece85_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

cee61f99f9b0b9e118ff49d8405ece85_JaffaCakes118
Size

643KB
MD5

cee61f99f9b0b9e118ff49d8405ece85
SHA1

2eeaa9117704d6103374db01a2117c3c3a42df30
SHA256

9ad323b95112e72c7a8eacb9cad47257bf27da4d92e61f9747171d10c276e8d0
SHA512

7db52166318d13c7ba4a4df551bcc1e0c034273b3a4e87837fc227c02f76fb448865ca7330e98e7005dba013d999949bf30869d2c47c9c0cf00c9ec8fe1b6519
SSDEEP

12288:4TW0zR/9lThgzEkrJlNJy2GlcC2g2vRtdDxOtNbsJ06WiIg9:olT2ZJlNg2nvvRtpxOzbI0NiN9

Score

10^/10

ammyyadmin

Malware Config

Signatures

AmmyyAdmin payload 1 IoCs

resource	yara_rule
sample	family_ammyyadmin

Ammyyadmin family
ammyyadmin

Files

cee61f99f9b0b9e118ff49d8405ece85_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec4b707c81e271c01d990c422be236bc

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17-05-2005 00:00

Not After

16-05-2010 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

92:ef:3f:37:21:6c:5b:81:11:5d:14:b2:85:dc:ad:6b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05-06-2009 00:00

Not After

05-06-2010 23:59

Subject

CN=Ammyy Group,O=Ammyy Group,POSTALCODE=117418,STREET=Novocheremushkinskaya 53-4,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:70:f9:e9:03:79:b9:70:04:72:e9:33:51:0d:87:c4:13:bb:1d:bc
Signer

Actual PE Digest

01:70:f9:e9:03:79:b9:70:04:72:e9:33:51:0d:87:c4:13:bb:1d:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetLastError
send
recv
shutdown
__WSAFDIsSet
accept
bind
listen
ioctlsocket
getservbyport
ntohs
gethostbyaddr
gethostbyname
getservbyname
htonl
inet_ntoa
inet_addr
socket
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
select
closesocket

gdi32

SetPixelV
GetSystemPaletteEntries
GetDIBits
GdiFlush
CombineRgn
CreateRectRgnIndirect
GetRegionData
CreateFontIndirectA
DPtoLP
GetDeviceCaps
GetStockObject
SetBkMode
SetStretchBltMode
CreateDIBSection
DeleteDC
CreateCompatibleDC
SetTextColor
SelectObject
GetObjectA
GetBitmapBits
ExtTextOutA
SetBkColor
SelectClipRgn
CreateRectRgn
CreatePalette
CreateCompatibleBitmap
RealizePalette
SetBrushOrgEx
StretchBlt
BitBlt
SetBitmapBits
UpdateColors
DeleteObject
SelectPalette

user32

SendMessageTimeoutA
FindWindowA
VkKeyScanExA
MapVirtualKeyA
GetIconInfo
IntersectRect
EqualRect
OpenInputDesktop
GetUserObjectInformationA
ReleaseDC
IsWindowVisible
EmptyClipboard
SetClipboardData
DrawIconEx
RegisterClassExA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageA
mouse_event
GetThreadDesktop
SetThreadDesktop
keybd_event
GetCursorInfo
IsDialogMessageA
GetDlgItemTextA
SetDlgItemInt
TranslateMessage
DispatchMessageA
GetKeyboardState
ToAsciiEx
GetKeyState
LoadKeyboardLayoutA
SetTimer
GetMessageA
MessageBoxA
SetDlgItemTextA
SetDlgItemTextW
DefWindowProcA
GetDC
SetWindowTextW
GetDlgItem
EnableWindow
EndDialog
LoadImageA
GetSubMenu
GetMenu
SetWindowLongA
DestroyAcceleratorTable
TranslateAcceleratorA
CreateAcceleratorTableA
wsprintfW
ReleaseCapture
SetCapture
MoveWindow
GetAsyncKeyState
RegisterClassExW
DestroyCursor
MessageBeep
MessageBoxW
GetCursorPos
SetCursorPos
GetSystemMetrics
GetClipboardOwner
OpenClipboard
GetClipboardData
CloseClipboard
SetScrollInfo
GetFocus
GetWindow
WindowFromPoint
ScreenToClient
SetClassLongA
ChangeClipboardChain
PostQuitMessage
EnumWindows
GetClassNameA
KillTimer
GetWindowLongW
SetRect
SetWindowPos
ShowScrollBar
IsIconic
ScrollWindowEx
SystemParametersInfoA
AdjustWindowRectEx
GetMenuState
GetWindowRect
GetWindowPlacement
SetWindowPlacement
GetSysColorBrush
RegisterClassW
DrawMenuBar
SetClipboardViewer
DrawTextA
DialogBoxIndirectParamA
DialogBoxParamA
CallWindowProcW
CallWindowProcA
DefWindowProcW
SetWindowLongW
IsWindowUnicode
GetSystemMenu
RedrawWindow
UpdateWindow
InvalidateRect
SendMessageW
CreateWindowExW
DrawStateA
DrawEdge
IsWindow
GetParent
DestroyWindow
wsprintfA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
SetCursor
LoadCursorA
DestroyIcon
PostThreadMessageA
GetSysColor
CreateWindowExA
BeginPaint
EndPaint
PostMessageA
LoadIconA
GetDlgItemInt
SendDlgItemMessageA
GetMenuItemID
EnableMenuItem
GetMenuItemCount
CheckMenuItem
SetForegroundWindow
SetFocus
GetWindowTextA
AppendMenuA
SetWindowTextA
ShowWindow
GetClientRect
SendMessageA
GetWindowLongA

shell32

ShellExecuteA
Shell_NotifyIconA
ShellExecuteExW
SHGetFileInfoW
SHGetFolderPathW
SHGetSpecialFolderPathW

msvcrt

_strnicmp
_strlwr
__CxxFrameHandler
strlen
isspace
memchr
_errno
strtol
isdigit
strstr
memcpy
??2@YAPAXI@Z
_purecall
sprintf
atol
_stricmp
_CxxThrowException
atoi
memset
abs
wcscmp
swprintf
wcscpy
_wtol
strcpy
iswspace
wcsncmp
wcslen
_wtoi
_ultow
wcschr
memcmp
strncpy
strchr
strcat
free
strtoul
calloc
strcmp
_ftol
wcsncpy
wcsrchr
vsprintf
vswprintf
memmove
strrchr
strncmp
mbstowcs
iswdigit
_beginthreadex
sscanf
_endthreadex
_i64tow
malloc
wcscat
time
srand
rand
exit
fprintf
_iob
getenv
floor
printf
realloc
fputc
_CIpow
_CIacos
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsrev
_wcsicmp

secur32

AcquireCredentialsHandleA
CompleteAuthToken
InitializeSecurityContextA
FreeCredentialsHandle
QuerySecurityPackageInfoA
FreeContextBuffer

comdlg32

GetOpenFileNameW
GetSaveFileNameW

userenv

LoadUserProfileA
UnloadUserProfile

comctl32

ord17
ImageList_ReplaceIcon
CreateToolbarEx
_TrackMouseEvent
CreatePropertySheetPageW
PropertySheetA
ImageList_Create
ImageList_Add
ImageList_Draw
ImageList_Destroy
ImageList_GetIconSize

advapi32

RegisterServiceCtrlHandlerExA
RegDeleteKeyA
RegSetValueExA
RegSetValueExW
RegQueryValueExW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclA
AllocateAndInitializeSid
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
StartServiceCtrlDispatcherA
SetServiceStatus
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CreateServiceW
DeleteService
ControlService
StartServiceA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo

wininet

HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetReadFile
InternetOpenA
HttpOpenRequestA

dsound

ord6
ord7
ord2
ord1

kernel32

FindResourceExA
SizeofResource
LoadResource
LockResource
GetLocalTime
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
OpenEventA
CreateEventA
ExitProcess
SetUnhandledExceptionFilter
GetLocaleInfoA
QueryPerformanceFrequency
DeviceIoControl
CompareFileTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
lstrcatW
LoadLibraryW
WaitNamedPipeW
ReadFile
SetLastError
GetExitCodeProcess
BeginUpdateResourceW
EndUpdateResourceW
UpdateResourceA
GetUserDefaultUILanguage
QueryPerformanceCounter
CreateMutexA
Sleep
GetSystemDirectoryA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
CreateThread
GetStartupInfoW
CreateProcessW
GetVersion
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LocalAlloc
GetExitCodeThread
SystemTimeToFileTime
MoveFileW
DeleteFileW
GetTempPathW
CreateFileW
FindFirstFileW
FindClose
CreateDirectoryW
SetCurrentDirectoryW
SetProcessShutdownParameters
GetVersionExA
GetCurrentProcess
GetLastError
CloseHandle
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrlenW
GlobalUnlock
GlobalLock
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GetComputerNameA
GlobalAlloc
GetDriveTypeW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetLogicalDrives
GetFileTime
SetFileTime
GlobalFree
CreateDirectoryA
IsBadReadPtr
lstrcmpA
LocalFileTimeToFileTime
TerminateProcess
lstrcpyA
GetCurrentDirectoryA
FindResourceA
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreA
SetThreadPriority
TlsSetValue
GetCurrentThread
TlsAlloc
ResumeThread
TlsGetValue
InterlockedExchange
GetStartupInfoA
CreateFileA

Sections

.text
Size: 440KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec4b707c81e271c01d990c422be236bc

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89Certificate

Extended Key Usages

Key Usages

92:ef:3f:37:21:6c:5b:81:11:5d:14:b2:85:dc:ad:6bCertificate

Extended Key Usages

Key Usages

01:70:f9:e9:03:79:b9:70:04:72:e9:33:51:0d:87:c4:13:bb:1d:bcSigner

Headers

File Characteristics

Imports

ws2_32

gdi32

user32

shell32

msvcrt

secur32

comdlg32

userenv

comctl32

advapi32

setupapi

wininet

dsound

kernel32

Sections

.text Size: 440KB - Virtual size: 438KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 72KB - Virtual size: 73KB

.rsrc Size: 68KB - Virtual size: 66KB

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

92:ef:3f:37:21:6c:5b:81:11:5d:14:b2:85:dc:ad:6b
Certificate

01:70:f9:e9:03:79:b9:70:04:72:e9:33:51:0d:87:c4:13:bb:1d:bc
Signer

.text
Size: 440KB - Virtual size: 438KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 72KB - Virtual size: 73KB

.rsrc
Size: 68KB - Virtual size: 66KB