ammyyadmin | 1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773

General

Target

1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Size

752KB
Sample

250112-hwaf6stqcn
MD5

6f9063367d2017134dc377e7e7aea1b0
SHA1

cf939b505705dad12d7ab796213f26e4ef3f2bee
SHA256

1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773
SHA512

68d6eaeeea60ec39857e3d0b5f8ef0996cc8c62a378cebe79c811c2c6959069d09aeec31bdbc8b92ce5064cee1c21b3965826f0fbd780e52d00a2b5d4156764e
SSDEEP

12288:Pc1dZibTD9uOroAgeHvCUt4RtlTc+YNKpQsNvVd1g:Pcc/DwOrZgeHv54Rt6+YNkQsNm

Score

10^/10

Malware Config

Targets

- Target
  
  1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
- Size
  
  752KB
- MD5
  
  6f9063367d2017134dc377e7e7aea1b0
- SHA1
  
  cf939b505705dad12d7ab796213f26e4ef3f2bee
- SHA256
  
  1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773
- SHA512
  
  68d6eaeeea60ec39857e3d0b5f8ef0996cc8c62a378cebe79c811c2c6959069d09aeec31bdbc8b92ce5064cee1c21b3965826f0fbd780e52d00a2b5d4156764e
- SSDEEP
  
  12288:Pc1dZibTD9uOroAgeHvCUt4RtlTc+YNKpQsNvVd1g:Pcc/DwOrZgeHv54Rt6+YNkQsNm
Score

10^/10

ammyyadmin flawedammyy discovery rat trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Ammyyadmin family
  ammyyadmin
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Flawedammyy family
  flawedammyy
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ammyy Admin

AmmyyAdmin payload

Ammyyadmin family

FlawedAmmyy RAT

Flawedammyy family

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2