ammyyadmin | 8d6e783c42531ba3a8c823293d399c08f0ef07c007213f40f253aea1ddfc7dfe | Triage

Submit
Reports

Overview

overview

Static

static

0dcf6b80de...18.exe

windows7-x64

0dcf6b80de...18.exe

windows10-2004-x64

Sharing

General

Target

0dcf6b80de9636e9f2d58825842404ee_JaffaCakes118
Size

704KB
Sample

241003-ej5j1atcnl
MD5

0dcf6b80de9636e9f2d58825842404ee
SHA1

56197059d0319560d256b067a90b01131cd44733
SHA256

8d6e783c42531ba3a8c823293d399c08f0ef07c007213f40f253aea1ddfc7dfe
SHA512

91bf4a8336420555d31bbd94c079f56575386c2a9659956def2be780c06ba6eb8b04a447c9109d739b081be0fd37248a077ac6381d05af0b54d393053d25a996
SSDEEP

12288:YKHp9fDIItMm2o44sGTdBqWvwD+8ChCbW3XTjY1r1RtH8ePhAU5u0AhpZxAhkg1:YorLkbDEhyW3XS1RtcePKUBATZx81

Score

10^/10

ammyyadmin flawedammyy discovery trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

0dcf6b80de9636e9f2d58825842404ee_JaffaCakes118.exe

Resource

win7-20240903-en

flawedammyy discovery trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

0dcf6b80de9636e9f2d58825842404ee_JaffaCakes118.exe

Resource

win10v2004-20240802-en

flawedammyy discovery trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  0dcf6b80de9636e9f2d58825842404ee_JaffaCakes118
- Size
  
  704KB
- MD5
  
  0dcf6b80de9636e9f2d58825842404ee
- SHA1
  
  56197059d0319560d256b067a90b01131cd44733
- SHA256
  
  8d6e783c42531ba3a8c823293d399c08f0ef07c007213f40f253aea1ddfc7dfe
- SHA512
  
  91bf4a8336420555d31bbd94c079f56575386c2a9659956def2be780c06ba6eb8b04a447c9109d739b081be0fd37248a077ac6381d05af0b54d393053d25a996
- SSDEEP
  
  12288:YKHp9fDIItMm2o44sGTdBqWvwD+8ChCbW3XTjY1r1RtH8ePhAU5u0AhpZxAhkg1:YorLkbDEhyW3XS1RtcePKUBATZx81
Score

10^/10

flawedammyy discovery trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

flawedammyydiscoverytrojan

behavioral2

flawedammyydiscoverytrojan

© 2018-2024

Terms | Privacy