Overview

overview

10

Static

static

10

Ammyy.exe

windows7-x64

10

Ammyy.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ammyy.exe

  • Size

    748KB

  • Sample

    241031-tfy1da1crd

  • MD5

    3b4ed97de29af222837095a7c411b8a1

  • SHA1

    ea003f86db4cf74e4348e7e43e4732597e04db96

  • SHA256

    74656a65e96590a2734384bf89cb9ff677dcedff5f6e937d350b9f46ec52cd0a

  • SHA512

    2e1d1365163b08310e5112063be8ebd0ec1aa8c20a0872eef021978d6eb04a7b3d50af0a6472c246443585e665df2daa1e1a44a166780a8bf01de098a016e572

  • SSDEEP

    12288:3VFUEuNmwvGrw9i0aTGRGicBckyyFRtWY1i3FTsvOVVUg0:XUEUUw9RaTNicBrPFRtJ1iVTsCZ0

Score
10/10
ammyyadminflawedammyydiscoverytrojan

Malware Config

Targets

    • Target

      Ammyy.exe

    • Size

      748KB

    • MD5

      3b4ed97de29af222837095a7c411b8a1

    • SHA1

      ea003f86db4cf74e4348e7e43e4732597e04db96

    • SHA256

      74656a65e96590a2734384bf89cb9ff677dcedff5f6e937d350b9f46ec52cd0a

    • SHA512

      2e1d1365163b08310e5112063be8ebd0ec1aa8c20a0872eef021978d6eb04a7b3d50af0a6472c246443585e665df2daa1e1a44a166780a8bf01de098a016e572

    • SSDEEP

      12288:3VFUEuNmwvGrw9i0aTGRGicBckyyFRtWY1i3FTsvOVVUg0:XUEUUw9RaTNicBrPFRtJ1iVTsCZ0

    Score
    10/10
    flawedammyydiscoverytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Flawedammyy family

      flawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks