ammyyadmin | 3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576 | Triage

Submit
Reports

Overview

overview

Static

static

3be888aaea...76.exe

windows7-x64

3be888aaea...76.exe

windows10-2004-x64

Sharing

General

Target

3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576
Size

651KB
Sample

250103-1ymtdsykgq
MD5

e59083fc9d80ed5b698c01ddfea8fcc1
SHA1

f1db45a790994aae4f96c3a1b98ddd5d1257f893
SHA256

3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576
SHA512

e6f3a1f1ef8956423e9d07aa57d251a3cc6de661d1c467f832e14822504df330f6099b1c5cbe79914c7cac63be2a2a7c3542f9b0ba92a0d26841ca8764346c34
SSDEEP

12288:2aA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:KkK+waI8JRQMEJ2rufRtse9rtv8zlBi3

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576.exe

Resource

win7-20241010-en

ammyyadmin flawedammyy discovery rat trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576.exe

Resource

win10v2004-20241007-en

ammyyadmin flawedammyy discovery rat trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576
- Size
  
  651KB
- MD5
  
  e59083fc9d80ed5b698c01ddfea8fcc1
- SHA1
  
  f1db45a790994aae4f96c3a1b98ddd5d1257f893
- SHA256
  
  3be888aaea64006a812de63d81597596777e3b4b03f12437ed720e23f4e66576
- SHA512
  
  e6f3a1f1ef8956423e9d07aa57d251a3cc6de661d1c467f832e14822504df330f6099b1c5cbe79914c7cac63be2a2a7c3542f9b0ba92a0d26841ca8764346c34
- SSDEEP
  
  12288:2aA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:KkK+waI8JRQMEJ2rufRtse9rtv8zlBi3
Score

10^/10

ammyyadmin flawedammyy discovery rat trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Ammyyadmin family
  ammyyadmin
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Flawedammyy family
  flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ammyyadminflawedammyydiscoveryrattrojan

behavioral2

ammyyadminflawedammyydiscoveryrattrojan

© 2018-2025

Terms | Privacy