Overview

overview

10

Static

static

10

ddf779787b...18.exe

windows7-x64

10

ddf779787b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddf779787b9403c02345a5d73552aaf4_JaffaCakes118

  • Size

    994KB

  • Sample

    240913-jewhra1gkr

  • MD5

    ddf779787b9403c02345a5d73552aaf4

  • SHA1

    ba16f883b9d48c4aab322147a01f36fbd711edca

  • SHA256

    86c868ac7491954a150fa2233079171d94cad030f0c2739c16cc17de9fa44eda

  • SHA512

    5c3978a03e7b5b5e3716d906e8f60202c1bde5fbbd53c1679c3eb5220ecce0a5e70bcfd77041e3c7b4bd0218b3b5b120ff6ec1389cb3d83875dc025a26667b0b

  • SSDEEP

    24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxN:dJ5gEKNikf3hBfUiWxN

Score
10/10
ammyyadmindiscoveryrat

Malware Config

Targets

    • Target

      ddf779787b9403c02345a5d73552aaf4_JaffaCakes118

    • Size

      994KB

    • MD5

      ddf779787b9403c02345a5d73552aaf4

    • SHA1

      ba16f883b9d48c4aab322147a01f36fbd711edca

    • SHA256

      86c868ac7491954a150fa2233079171d94cad030f0c2739c16cc17de9fa44eda

    • SHA512

      5c3978a03e7b5b5e3716d906e8f60202c1bde5fbbd53c1679c3eb5220ecce0a5e70bcfd77041e3c7b4bd0218b3b5b120ff6ec1389cb3d83875dc025a26667b0b

    • SSDEEP

      24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxN:dJ5gEKNikf3hBfUiWxN

    Score
    10/10
    ammyyadmindiscoveryrat

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks