Overview

overview

10

Static

static

10

db0bec2422...18.exe

windows7-x64

10

db0bec2422...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db0bec24224436395853f7d30405ee1d_JaffaCakes118

  • Size

    994KB

  • Sample

    240911-xyqnhaycmd

  • MD5

    db0bec24224436395853f7d30405ee1d

  • SHA1

    9721cf5b6b3e5c0083542088fad9026359a218d8

  • SHA256

    00a5423e84c76499f87923f577078fc4c360c86721e08f9e9b58d2d13599e05f

  • SHA512

    2048e58385f437fdcd0bae4c92811a41980d8b15daac7ed7081cbf1ddc5f1aa82319fe9d8c56117d3e499241c491052f7c09450ebe19601e423db8bb941fe885

  • SSDEEP

    24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxL:dJ5gEKNikf3hBfUiWxL

Score
10/10
ammyyadmindiscoveryrat

Malware Config

Targets

    • Target

      db0bec24224436395853f7d30405ee1d_JaffaCakes118

    • Size

      994KB

    • MD5

      db0bec24224436395853f7d30405ee1d

    • SHA1

      9721cf5b6b3e5c0083542088fad9026359a218d8

    • SHA256

      00a5423e84c76499f87923f577078fc4c360c86721e08f9e9b58d2d13599e05f

    • SHA512

      2048e58385f437fdcd0bae4c92811a41980d8b15daac7ed7081cbf1ddc5f1aa82319fe9d8c56117d3e499241c491052f7c09450ebe19601e423db8bb941fe885

    • SSDEEP

      24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxL:dJ5gEKNikf3hBfUiWxL

    Score
    10/10
    ammyyadmindiscoveryrat

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks