ammyyadmin | ac9ca1ada708e146492076eb2051c874917f65271506caa57e7901e9c46a4609

General

Target

ac9ca1ada708e146492076eb2051c874917f65271506caa57e7901e9c46a4609
Size

976KB
Sample

250127-cz5htswme1
MD5

679425d4dad77902cf06eec729aef764
SHA1

26d2a0f339f508cf508e86c817f0aca53f61c510
SHA256

ac9ca1ada708e146492076eb2051c874917f65271506caa57e7901e9c46a4609
SHA512

74344889484c0e2867278a352e36b09cde5de8d984ddf67ca7779072942e3225d656395489b892b7137baaf90f3d59925852d8b34e6a5ed116806babdd4ea609
SSDEEP

24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxq:7J5gEKNikf3hBfUiWxq

Score

10^/10

Malware Config

Targets

- Target
  
  ac9ca1ada708e146492076eb2051c874917f65271506caa57e7901e9c46a4609
- Size
  
  976KB
- MD5
  
  679425d4dad77902cf06eec729aef764
- SHA1
  
  26d2a0f339f508cf508e86c817f0aca53f61c510
- SHA256
  
  ac9ca1ada708e146492076eb2051c874917f65271506caa57e7901e9c46a4609
- SHA512
  
  74344889484c0e2867278a352e36b09cde5de8d984ddf67ca7779072942e3225d656395489b892b7137baaf90f3d59925852d8b34e6a5ed116806babdd4ea609
- SSDEEP
  
  24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxq:7J5gEKNikf3hBfUiWxq
Score

10^/10

ammyyadmin discovery rat upx
- Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- AmmyyAdmin payload
- Ammyyadmin family
  ammyyadmin
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ammyy Admin

AmmyyAdmin payload

Ammyyadmin family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2