Overview

overview

10

Static

static

10

JaffaCakes...90.exe

windows7-x64

10

JaffaCakes...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_60597829cac84b6e44e6b5608bad1e90

  • Size

    747KB

  • Sample

    250101-ymhzys1mex

  • MD5

    60597829cac84b6e44e6b5608bad1e90

  • SHA1

    45d990dc27a24806a5358b5aa99bf0f6e34bd230

  • SHA256

    ee4fad528992868087d6842e08ee1cf51b6e40f27d5d7a663dbb639ad94f8f95

  • SHA512

    2c99cdab0c6935337ae3fe8db16d45ee071b84bc30421c19cdf187d139272cb57d8c36d6af791ed2c414775d4554007a21d1d8347095477c9c67cc1f3ca7cf79

  • SSDEEP

    12288:8YdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzagMG:HdNikfu2hBfK8ilRty5olGJsxNMG

Score
10/10
ammyyadminflawedammyydiscoverytrojan

Malware Config

Targets

    • Target

      JaffaCakes118_60597829cac84b6e44e6b5608bad1e90

    • Size

      747KB

    • MD5

      60597829cac84b6e44e6b5608bad1e90

    • SHA1

      45d990dc27a24806a5358b5aa99bf0f6e34bd230

    • SHA256

      ee4fad528992868087d6842e08ee1cf51b6e40f27d5d7a663dbb639ad94f8f95

    • SHA512

      2c99cdab0c6935337ae3fe8db16d45ee071b84bc30421c19cdf187d139272cb57d8c36d6af791ed2c414775d4554007a21d1d8347095477c9c67cc1f3ca7cf79

    • SSDEEP

      12288:8YdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzagMG:HdNikfu2hBfK8ilRty5olGJsxNMG

    Score
    10/10
    flawedammyydiscoverytrojan

    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Flawedammyy family

      flawedammyy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks