ammyyadmin | 85841700199bb0762518be8266169250ed6a0b4e48e6dfb4e47b8da5c78d12c8

General

Target

d281e5deaca5508ef83398adf429873e_JaffaCakes118
Size

8.5MB
Sample

240907-wd5fgsydja
MD5

d281e5deaca5508ef83398adf429873e
SHA1

59b78c59d86b41d13ed44e3221e5f9b544ff60f9
SHA256

85841700199bb0762518be8266169250ed6a0b4e48e6dfb4e47b8da5c78d12c8
SHA512

458df975b37083dfd87f1f00f22755ff6fbd0ffc4bdd7eff738adea67ee23c4d5a0d01cfe591eaa44a8cefa8c2468ef331de79be52e8b8bdeddbc31a9c2fff76
SSDEEP

196608:w30KttkD7E51301Y9X1xdi+L1DWNuPItExRb5IVDo388MB7khmT:wEMkXE51MY99WNuP11omMgmT

Score

10^/10

Malware Config

Targets

- Target
  
  DATA/OS/OKOF.HTM
- Size
  
  260KB
- MD5
  
  aecda5ac137cf4d41c85aacc14871857
- SHA1
  
  c5eec535c50840e48badcf51f8f486c6ecdbe85d
- SHA256
  
  8ec77acbf9324dd48707e114988f3af931100d4fede03dd5210864f8d0e77eb3
- SHA512
  
  082edee8fa308b89ced253d6eea99360d8ee5ec8c0bd2541a1c58ced27dc38c7b6d0b6607f472c4bd63ee75f8a9baa40996d37271cbd05a3f4c832111c194157
- SSDEEP
  
  768:LYVz0Z/fX9zX5OiMYGxOFYMxOsMYq6IU5IxprilxIDxI6Mi4xIbidxIuI+F/xIkI:LYCsxZyCan5pgofoWw+VBd9885M
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  DATA/tv/RemoteHelper.exe
- Size
  
  2.4MB
- MD5
  
  eab6450adf406fb350e611f5dacd4600
- SHA1
  
  dcd89b9de03246dfaa9682358da7169e1be87574
- SHA256
  
  b215b6042d7a72beb408540b034081901e017ed730341d8d7c7d380582267e2a
- SHA512
  
  f3f0da58c5eaa61b51f825557c20cb9f5ebbf119e201bc1f3c44b8d2b2f19c0dc46a0b17a1fd537fcf4fa6f71fe3d80bad5d8efd132bb5630beaf898adbfbf04
- SSDEEP
  
  49152:GOgmmzZJyWAfF7rt/l4kWKENl6vkj4BomLOfGPVpeyWnoDc2hsiC:Gtk7Z/l4t6v9Gm0MOD2ZC
Score

7^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  
  DATA/tv/aa_v3.exe
- Size
  
  726KB
- MD5
  
  d22d719495f23e38805bbea5df434abb
- SHA1
  
  3cfeeb974e65c0ba671d81459d2c6b694d5d4eaf
- SHA256
  
  b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20
- SHA512
  
  d87670775d222b25b329377c8d26c2a4c88ce6b1aa1d6fc004b95ad93f377fd56fb03e709b4b61b26c4fcf06fe477e42afe9f9715884ea91699548b1e4d4a4c7
- SSDEEP
  
  12288:ozJUxbtiiTHRJuEkQO7EwC2ZwFRtAdRXRryd+sq1zsgp:o9oNTHRz/O7rT6FRteRXR2IsqXp
Score

10^/10

flawedammyy discovery trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral5 behavioral6