ammyyadmin | 5ca36273f06f80cd1b8aebcdb921fa8a44e1b66cf94fb48a44220feaa51be85b

General

Target

HashIs-5ca36273f06f80cd1b8aebcdb921fa8a44e1b66cf94fb48a44220feaa51be85b
Size

995KB
Sample

241201-p9m3rasjct
MD5

d8fd463f5ac1a9f91c1348dce1b9c0d0
SHA1

87a51b2806a844260a33e36bb7ec481713fd0d73
SHA256

5ca36273f06f80cd1b8aebcdb921fa8a44e1b66cf94fb48a44220feaa51be85b
SHA512

ccace492f2ffd44c239b8d9bb06febe5d0c8ec3573e072e5256b448bf53de2f3e91fe001250609603c84f3da9f8cd1ffa202356fe74e5607e358984c183fa473
SSDEEP

24576:rMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxo:mJ5gEKNikf3hBfUiWxo

Score

10^/10

Malware Config

Targets

- Target
  
  HashIs-5ca36273f06f80cd1b8aebcdb921fa8a44e1b66cf94fb48a44220feaa51be85b
- Size
  
  995KB
- MD5
  
  d8fd463f5ac1a9f91c1348dce1b9c0d0
- SHA1
  
  87a51b2806a844260a33e36bb7ec481713fd0d73
- SHA256
  
  5ca36273f06f80cd1b8aebcdb921fa8a44e1b66cf94fb48a44220feaa51be85b
- SHA512
  
  ccace492f2ffd44c239b8d9bb06febe5d0c8ec3573e072e5256b448bf53de2f3e91fe001250609603c84f3da9f8cd1ffa202356fe74e5607e358984c183fa473
- SSDEEP
  
  24576:rMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxo:mJ5gEKNikf3hBfUiWxo
Score

10^/10

ammyyadmin discovery rat upx
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Ammyyadmin family
  ammyyadmin
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ammyy Admin

AmmyyAdmin payload

Ammyyadmin family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2