ammyyadmin | d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605 | Triage

Sharing

General

Target

d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605.exe
Size

762KB
Sample

241018-dcejkawaqm
MD5

e9b569f7cbf23d91df065c18f4c43840
SHA1

5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad
SHA256

d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605
SHA512

a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb
SSDEEP

12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte

Score

10^/10

ammyyadmin flawedammyy discovery trojan

Malware Config

Targets

- Target
  
  d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605.exe
- Size
  
  762KB
- MD5
  
  e9b569f7cbf23d91df065c18f4c43840
- SHA1
  
  5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad
- SHA256
  
  d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605
- SHA512
  
  a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb
- SSDEEP
  
  12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte
Score

10^/10

flawedammyy discovery trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

flawedammyydiscoverytrojan

behavioral2

flawedammyydiscoverytrojan