ammyyadmin | 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8c

General

Target

792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe
Size

994KB
Sample

250107-kwgatswkbn
MD5

f751a2295024cb156e021fee9c86df40
SHA1

a0cee6ec85b8a3d13e002a42424a7076748dff20
SHA256

792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8c
SHA512

38dafa748a3d9b14a070f63b100975702012cdcf78d83d12af6e2bf0eb809b98ed1be5926c836dafb433bc1df22fdeb0f6f79017dda2fbdccdf08df8733c9f30
SSDEEP

24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxe:7J5gEKNikf3hBfUiWxe

Score

10^/10

Malware Config

Targets

- Target
  
  792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe
- Size
  
  994KB
- MD5
  
  f751a2295024cb156e021fee9c86df40
- SHA1
  
  a0cee6ec85b8a3d13e002a42424a7076748dff20
- SHA256
  
  792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8c
- SHA512
  
  38dafa748a3d9b14a070f63b100975702012cdcf78d83d12af6e2bf0eb809b98ed1be5926c836dafb433bc1df22fdeb0f6f79017dda2fbdccdf08df8733c9f30
- SSDEEP
  
  24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxe:7J5gEKNikf3hBfUiWxe
Score

10^/10

ammyyadmin discovery rat upx
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Ammyyadmin family
  ammyyadmin
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ammyy Admin

AmmyyAdmin payload

Ammyyadmin family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2