flawedammyy | 4a9b69734b1ff51dd357edc6addf122e43b08ea7e36d62026b4a27a8da8ad26c

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/02/2025, 22:56 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AMMYY_Admin.exe
Size

651KB
MD5

b730e7b8f3eebd51dc21d7997313b890
SHA1

57ef7a2d07f3703f84c1d7ad33e34e550d23a6fa
SHA256

e4a87095c27219afe9c7a3cb01c13de899e201d2340748a5fc446207c8f99b2a
SHA512

05e87e0ac0e6c097cec3e3801c66752f1a69bd3f8b732062b16596fd4e46388e66eb2e4455ede69769dad62cb7a063849cc2199c140c6ba6a498173eaafe051d
SSDEEP

12288:caA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:AkK+waI8JRQMEJ2rufRtse9rtv8zlBi3

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation	AMMYY_Admin.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	AMMYY_Admin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	AMMYY_Admin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	AMMYY_Admin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CCEC92414B6E1024FB3D94B5519ECEC5	AMMYY_Admin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CCEC92414B6E1024FB3D94B5519ECEC5	AMMYY_Admin.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AMMYY_Admin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AMMYY_Admin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AMMYY_Admin.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5B4C3FB0-3E22-40A0-BABB-99FD0D58B6EF}	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AMMYY_Admin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AMMYY_Admin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-13-08-06-8b-86\WpadDecisionReason = "1"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AMMYY_Admin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5B4C3FB0-3E22-40A0-BABB-99FD0D58B6EF}\WpadNetworkName = "Network 3"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AMMYY_Admin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00eb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5B4C3FB0-3E22-40A0-BABB-99FD0D58B6EF}\WpadDecision = "0"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5B4C3FB0-3E22-40A0-BABB-99FD0D58B6EF}\WpadDecisionReason = "1"	AMMYY_Admin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-13-08-06-8b-86\WpadDecisionTime = d0228c57a17ddb01	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AMMYY_Admin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AMMYY_Admin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	AMMYY_Admin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5B4C3FB0-3E22-40A0-BABB-99FD0D58B6EF}\WpadDecisionTime = d0228c57a17ddb01	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5B4C3FB0-3E22-40A0-BABB-99FD0D58B6EF}\8a-13-08-06-8b-86	AMMYY_Admin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-13-08-06-8b-86\WpadDecision = "0"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AMMYY_Admin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-13-08-06-8b-86	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AMMYY_Admin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AMMYY_Admin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AMMYY_Admin.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	AMMYY_Admin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	AMMYY_Admin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AMMYY_Admin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2812	AMMYY_Admin.exe
Token: SeRestorePrivilege	2812	AMMYY_Admin.exe
Token: SeBackupPrivilege	2812	AMMYY_Admin.exe
Token: SeRestorePrivilege	2812	AMMYY_Admin.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	AMMYY_Admin.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2812	AMMYY_Admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2812	2684	AMMYY_Admin.exe	31
PID 2684 wrote to memory of 2812	2684	AMMYY_Admin.exe	31
PID 2684 wrote to memory of 2812	2684	AMMYY_Admin.exe	31
PID 2684 wrote to memory of 2812	2684	AMMYY_Admin.exe	31

C:\Users\Admin\AppData\Local\Temp\AMMYY_Admin.exe
"C:\Users\Admin\AppData\Local\Temp\AMMYY_Admin.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2708

C:\Users\Admin\AppData\Local\Temp\AMMYY_Admin.exe
"C:\Users\Admin\AppData\Local\Temp\AMMYY_Admin.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\AMMYY_Admin.exe
  "C:\Users\Admin\AppData\Local\Temp\AMMYY_Admin.exe"
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2812

Network

DNS

rl.ammyy.com

AMMYY_Admin.exe

Remote address:

8.8.8.8:53

Request

rl.ammyy.com

IN A

Response

rl.ammyy.com

IN A

188.42.129.148
POST

http://rl.ammyy.com/

AMMYY_Admin.exe

Remote address:

188.42.129.148:80

Request

POST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: rl.ammyy.com
Content-Length: 143
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Wed, 12 Feb 2025 22:56:18 GMT
Server: Apache
X-Powered-By: PHP/5.4.16
Content-Length: 92
Content-Type: text/html
DNS

www.ammyy.com

AMMYY_Admin.exe

Remote address:

8.8.8.8:53

Request

www.ammyy.com

IN A

Response

www.ammyy.com

IN A

136.243.18.118
GET

http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

AMMYY_Admin.exe

Remote address:

136.243.18.118:80

Request

GET /admin_v3.9_20200220-182209/AA_v3.exe HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Range: bytes=0-
Accept-Encoding: gzip, deflate
Host: www.ammyy.com
Cache-Control: no-cache

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Feb 2025 22:56:22 GMT
Server: Apache/2.4.6 (CentOS)
Location: https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe
Content-Length: 344
Connection: close
Content-Type: text/html; charset=iso-8859-1
GET

https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

AMMYY_Admin.exe

Remote address:

136.243.18.118:443

Request

GET /admin_v3.9_20200220-182209/AA_v3.exe HTTP/1.1
Connection: Keep-Alive
Range: bytes=0-
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
Host: www.ammyy.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Feb 2025 22:56:23 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 313
Connection: close
Content-Type: text/html; charset=iso-8859-1
DNS

r10.o.lencr.org

AMMYY_Admin.exe

Remote address:

8.8.8.8:53

Request

r10.o.lencr.org

IN A

Response

r10.o.lencr.org

IN CNAME

o.lencr.edgesuite.net

o.lencr.edgesuite.net

IN CNAME

a1887.dscq.akamai.net

a1887.dscq.akamai.net

IN A

104.86.110.232

a1887.dscq.akamai.net

IN A

104.86.110.200
GET

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgPPWIcoBZfKmcXEgffa%2BM%2Fi9w%3D%3D

AMMYY_Admin.exe

Remote address:

104.86.110.232:80

Request

GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgPPWIcoBZfKmcXEgffa%2BM%2Fi9w%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: r10.o.lencr.org

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "62D750DDF02E3CEB260D121DEC3341C2690184EB85A86FEDAF4481883D8F0472"
Last-Modified: Tue, 11 Feb 2025 02:22:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2159
Expires: Wed, 12 Feb 2025 23:32:22 GMT
Date: Wed, 12 Feb 2025 22:56:23 GMT
Connection: keep-alive
POST

http://rl.ammyy.com/

AMMYY_Admin.exe

Remote address:

188.42.129.148:80

Request

POST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: rl.ammyy.com
Content-Length: 165
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Wed, 12 Feb 2025 22:56:34 GMT
Server: Apache
X-Powered-By: PHP/5.4.16
Content-Length: 92
Content-Type: text/html
GET

http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

AMMYY_Admin.exe

Remote address:

136.243.18.118:80

Request

GET /admin_v3.9_20200220-182209/AA_v3.exe HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Range: bytes=0-
Accept-Encoding: gzip, deflate
Host: www.ammyy.com
Cache-Control: no-cache

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 12 Feb 2025 22:56:40 GMT
Server: Apache/2.4.6 (CentOS)
Location: https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe
Content-Length: 344
Connection: close
Content-Type: text/html; charset=iso-8859-1
GET

https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

AMMYY_Admin.exe

Remote address:

136.243.18.118:443

Request

GET /admin_v3.9_20200220-182209/AA_v3.exe HTTP/1.1
Connection: Keep-Alive
Range: bytes=0-
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
Host: www.ammyy.com

Response

HTTP/1.1 404 Not Found

Date: Wed, 12 Feb 2025 22:56:40 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 313
Connection: close
Content-Type: text/html; charset=iso-8859-1

188.42.129.148:80

http://rl.ammyy.com/

http

AMMYY_Admin.exe

651 B
722 B
8
6

HTTP Request

POST http://rl.ammyy.com/

HTTP Response

200
136.243.18.118:80

http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

http

AMMYY_Admin.exe

526 B
813 B
7
5

HTTP Request

GET http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

HTTP Response

301
136.243.18.118:443

https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

tls, http

AMMYY_Admin.exe

1.2kB
3.8kB
10
9

HTTP Request

GET https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

HTTP Response

404
104.86.110.232:80

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgPPWIcoBZfKmcXEgffa%2BM%2Fi9w%3D%3D

http

AMMYY_Admin.exe

531 B
2.0kB
6
5

HTTP Request

GET http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgPPWIcoBZfKmcXEgffa%2BM%2Fi9w%3D%3D

HTTP Response

200
188.42.129.148:80

http://rl.ammyy.com/

http

AMMYY_Admin.exe

955 B
682 B
14
5

HTTP Request

POST http://rl.ammyy.com/

HTTP Response

200
136.243.18.118:80

http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

http

AMMYY_Admin.exe

770 B
865 B
8
6

HTTP Request

GET http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

HTTP Response

301
136.243.18.118:443

https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

tls, http

AMMYY_Admin.exe

1.1kB
3.7kB
8
8

HTTP Request

GET https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

HTTP Response

404

8.8.8.8:53

rl.ammyy.com

dns

AMMYY_Admin.exe

58 B
74 B
1
1

DNS Request

rl.ammyy.com

DNS Response

188.42.129.148
8.8.8.8:53

www.ammyy.com

dns

AMMYY_Admin.exe

59 B
75 B
1
1

DNS Request

www.ammyy.com

DNS Response

136.243.18.118
8.8.8.8:53

r10.o.lencr.org

dns

AMMYY_Admin.exe

61 B
160 B
1
1

DNS Request

r10.o.lencr.org

DNS Response

104.86.110.232

104.86.110.200

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\settings.bin

Filesize
76B

MD5
090bba5cbe9cd62189310f633f14d686

SHA1
0ce1d78aace04650b0c592665686a89412c1771c

SHA256
7bc48188bbd0ad1b7ac10257e6a8fc5327f2ccfd56402a4353f6d8ef26eb0ff8

SHA512
846781bdb4d8902963f1859077c8db4c763fdd4ca28f0be83b95c20d324b5db030f312fc3d4f959dc05ca4f41ef872a49d123195494b16440e16ebcc5edb31a7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.