ammyyadmin | b88f6c305d8066f04f98419a2705f82976e225b886d0d621ec9aa6fa33c6956f

General

Target

025754318db94857d12110b010fe457d_JaffaCakes118
Size

885KB
Sample

240930-vd5wkszcjh
MD5

025754318db94857d12110b010fe457d
SHA1

e195e19413b83b2621d69d1b92cabcc94b3ebdd7
SHA256

b88f6c305d8066f04f98419a2705f82976e225b886d0d621ec9aa6fa33c6956f
SHA512

f930249d408f339a45baa6e5f9ebf681026666ae6e840181a67854cb4a4239f2d2a6f500d8d43e9ad1009158397a96c37dbe300414b82972b4e3effb0698c9d3
SSDEEP

24576:SZTqYfOectmtS4Px1Rt4MmqZZtU6N+Q1384XmD:SZTqBe6m8yx57tH138xD

Score

10^/10

Malware Config

Targets

- Target
  
  025754318db94857d12110b010fe457d_JaffaCakes118
- Size
  
  885KB
- MD5
  
  025754318db94857d12110b010fe457d
- SHA1
  
  e195e19413b83b2621d69d1b92cabcc94b3ebdd7
- SHA256
  
  b88f6c305d8066f04f98419a2705f82976e225b886d0d621ec9aa6fa33c6956f
- SHA512
  
  f930249d408f339a45baa6e5f9ebf681026666ae6e840181a67854cb4a4239f2d2a6f500d8d43e9ad1009158397a96c37dbe300414b82972b4e3effb0698c9d3
- SSDEEP
  
  24576:SZTqYfOectmtS4Px1Rt4MmqZZtU6N+Q1384XmD:SZTqBe6m8yx57tH138xD
Score

10^/10

ammyyadmin flawedammyy discovery rat trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ammyy Admin

AmmyyAdmin payload

FlawedAmmyy RAT

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2