Overview

overview

10

Static

static

10

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    762KB

  • Sample

    241017-s4bpbatamg

  • MD5

    e9b569f7cbf23d91df065c18f4c43840

  • SHA1

    5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad

  • SHA256

    d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605

  • SHA512

    a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb

  • SSDEEP

    12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte

Score
10/10
ammyyadminflawedammyydiscoverytrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      762KB

    • MD5

      e9b569f7cbf23d91df065c18f4c43840

    • SHA1

      5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad

    • SHA256

      d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605

    • SHA512

      a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb

    • SSDEEP

      12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte

    Score
    10/10
    flawedammyydiscoverytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks