ammyyadmin | 4a9b69734b1ff51dd357edc6addf122e43b08ea7e36d62026b4a27a8da8ad26c | Triage

Submit
Reports

Overview

overview

Static

static

AMMYY_Admin.exe

windows7-x64

AMMYY_Admin.exe

windows10-2004-x64

Sharing

General

Target

4a9b69734b1ff51dd357edc6addf122e43b08ea7e36d62026b4a27a8da8ad26c
Size

306KB
Sample

250212-2wr6rszjcr
MD5

1eef4d3f5b8d2094ffeeb683b81bf514
SHA1

085f744ae5a59616d0ed18e574c379c3731f362f
SHA256

4a9b69734b1ff51dd357edc6addf122e43b08ea7e36d62026b4a27a8da8ad26c
SHA512

50bf2bb6d028a4785ef2d23bcd965f721326e99581f50fc304f13e2c78386b8d2e97235164686ac95ac2c9789602a358a240f9de4adfaeee3fb7120efe2a868f
SSDEEP

6144:nBu/emAB6ghBUhnV6Gae6zjunPGxnRgXukHu48hBWTntyFy4kog9x1ciqUzkhUyU:8/eBuX61eUc+gO4zkfmKiqUzkeyZm

Score

10^/10

ammyyadmin flawedammyy discovery trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

AMMYY_Admin.exe

Resource

win7-20240903-en

flawedammyy discovery trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

AMMYY_Admin.exe

Resource

win10v2004-20250207-en

flawedammyy discovery trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  AMMYY_Admin.exe
- Size
  
  651KB
- MD5
  
  b730e7b8f3eebd51dc21d7997313b890
- SHA1
  
  57ef7a2d07f3703f84c1d7ad33e34e550d23a6fa
- SHA256
  
  e4a87095c27219afe9c7a3cb01c13de899e201d2340748a5fc446207c8f99b2a
- SHA512
  
  05e87e0ac0e6c097cec3e3801c66752f1a69bd3f8b732062b16596fd4e46388e66eb2e4455ede69769dad62cb7a063849cc2199c140c6ba6a498173eaafe051d
- SSDEEP
  
  12288:caA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:AkK+waI8JRQMEJ2rufRtse9rtv8zlBi3
Score

10^/10

flawedammyy discovery trojan
- FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Flawedammyy family
  flawedammyy
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

flawedammyydiscoverytrojan

behavioral2

flawedammyydiscoverytrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.