Overview

overview

10

Static

static

10

ff56cce8f2...18.exe

windows7-x64

10

ff56cce8f2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff56cce8f2ee848fc528e1e52845964a_JaffaCakes118

  • Size

    993KB

  • Sample

    240929-zycsravcla

  • MD5

    ff56cce8f2ee848fc528e1e52845964a

  • SHA1

    71eb7d51b6ebb45bfc9f276fd830feecd34393a7

  • SHA256

    4a24148bc10b7549347435dc0ce29d9e3a71ee440c2421060fc1aca74cb1061f

  • SHA512

    74af8caa93ca1bc5746f1e78e06b86a7e1a418e2838707a957b1b017fc8d8d19ed66e6a5326d646d1da015c6c72f36ceb8c7a0920876ae842771df0bd291ab05

  • SSDEEP

    24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxN:dJ5gEKNikf3hBfUiWxN

Score
10/10
ammyyadmindiscoveryrat

Malware Config

Targets

    • Target

      ff56cce8f2ee848fc528e1e52845964a_JaffaCakes118

    • Size

      993KB

    • MD5

      ff56cce8f2ee848fc528e1e52845964a

    • SHA1

      71eb7d51b6ebb45bfc9f276fd830feecd34393a7

    • SHA256

      4a24148bc10b7549347435dc0ce29d9e3a71ee440c2421060fc1aca74cb1061f

    • SHA512

      74af8caa93ca1bc5746f1e78e06b86a7e1a418e2838707a957b1b017fc8d8d19ed66e6a5326d646d1da015c6c72f36ceb8c7a0920876ae842771df0bd291ab05

    • SSDEEP

      24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxN:dJ5gEKNikf3hBfUiWxN

    Score
    10/10
    ammyyadmindiscoveryrat

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks