ammyyadmin | 23da52f1f639e19c4fd6494c8858efbb75321b2424e1a162f9146607102d6482 | Triage

Resubmissions

15-01-2025 16:15

250115-tqnx6ayrgq 3

15-01-2025 14:57

250115-sbyndaxmfp 10

Sharing

General

Target

MDE_File_Sample_050b7eba825412b24e3f02d76d7da5ae97e10502.zip
Size

424KB
Sample

250115-sbyndaxmfp
MD5

33b8e032a8e8a2336d3ac91916acdb85
SHA1

682ac5bfbe01633854670e2dba5cd1c108c40b7b
SHA256

23da52f1f639e19c4fd6494c8858efbb75321b2424e1a162f9146607102d6482
SHA512

d69b82993405571ca8aa89c3bb054c89ee5b6af26fd1b489dd2f8df43e561b91dc2d978ee6ca3923f53f8dc70419f11d617b7f2d0d50003aeb18d663270b0c1c
SSDEEP

6144:DHZe8QrJS/sVebaJS3TJI1UCfygv7TEfuJaR+weHpCMvwyQZ/aIJ66PueapTU4e9:Dgrro/dOJS31GouzIc6Vaq5

Score

10^/10

ammyyadmin flawedammyy bootkit discovery persistence rat trojan

Malware Config

Targets

- Target
  
  MDE_File_Sample_050b7eba825412b24e3f02d76d7da5ae97e10502.zip
- Size
  
  424KB
- MD5
  
  33b8e032a8e8a2336d3ac91916acdb85
- SHA1
  
  682ac5bfbe01633854670e2dba5cd1c108c40b7b
- SHA256
  
  23da52f1f639e19c4fd6494c8858efbb75321b2424e1a162f9146607102d6482
- SHA512
  
  d69b82993405571ca8aa89c3bb054c89ee5b6af26fd1b489dd2f8df43e561b91dc2d978ee6ca3923f53f8dc70419f11d617b7f2d0d50003aeb18d663270b0c1c
- SSDEEP
  
  6144:DHZe8QrJS/sVebaJS3TJI1UCfygv7TEfuJaR+weHpCMvwyQZ/aIJ66PueapTU4e9:Dgrro/dOJS31GouzIc6Vaq5
Score

10^/10

ammyyadmin flawedammyy bootkit discovery persistence rat trojan
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Ammyyadmin family
  ammyyadmin
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Flawedammyy family
  flawedammyy
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ammyyadminflawedammyybootkitdiscoverypersistencerattrojan

behavioral2