Overview

overview

10

Static

static

10

c1cf96e5e6...97.exe

windows7-x64

10

c1cf96e5e6...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1cf96e5e6a7be560cf79746d90522928bacd828554978c9e8a09a28bd3b6097.exe

  • Size

    975KB

  • Sample

    250110-z5m73axqbv

  • MD5

    6641121be4ec07e172daf0370f969f37

  • SHA1

    4eaf19ac2053628d0a4c8e85086a05a56f6fff8f

  • SHA256

    c1cf96e5e6a7be560cf79746d90522928bacd828554978c9e8a09a28bd3b6097

  • SHA512

    3d425c22eda7e18280d21e1f7e17486d574aeffee8123ed2aa2fdd4814e901094b7f7a0c73abea89c11cc1ceef6b5f34e6bd8d108c67ce8e7edcf08f6c713ae7

  • SSDEEP

    24576:eMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxf:bJ5gEKNikf3hBfUiWxf

Score
10/10
ammyyadmindiscoveryrat

Malware Config

Targets

    • Target

      c1cf96e5e6a7be560cf79746d90522928bacd828554978c9e8a09a28bd3b6097.exe

    • Size

      975KB

    • MD5

      6641121be4ec07e172daf0370f969f37

    • SHA1

      4eaf19ac2053628d0a4c8e85086a05a56f6fff8f

    • SHA256

      c1cf96e5e6a7be560cf79746d90522928bacd828554978c9e8a09a28bd3b6097

    • SHA512

      3d425c22eda7e18280d21e1f7e17486d574aeffee8123ed2aa2fdd4814e901094b7f7a0c73abea89c11cc1ceef6b5f34e6bd8d108c67ce8e7edcf08f6c713ae7

    • SSDEEP

      24576:eMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxf:bJ5gEKNikf3hBfUiWxf

    Score
    10/10
    ammyyadmindiscoveryrat

    • Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • AmmyyAdmin payload

    • Ammyyadmin family

      ammyyadmin

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks