Overview

overview

10

Static

static

1

test.txt

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    test.txt
  • Size 1KB
  • Sample260414-pw4tcaev7t
  • SHA256 aeb0616a6043f7439ee5bc2e3b8920bc7547ae1a910ad6d4a27b8385ff2d6463
  • MD5 SHA1 SHA512
Score
10/10
ammyyadminflawedammyybootkitdefense_evasiondiscoverypersistenceransomwarerattrojan

Malware Config

Targets

    • Target
      test.txt
    • Size 1KB
    • SHA256 aeb0616a6043f7439ee5bc2e3b8920bc7547ae1a910ad6d4a27b8385ff2d6463
    • MD5 SHA1 SHA512
    Score
    10/10
    bootkitdefense_evasiondiscoveryammyyadminflawedammyypersistenceransomwarerattrojan

    • AmmyyAdmin payload

    • Family: Ammyy Admin

      Remote admin tool with various capabilities.

      ratammyyadmin

    • Family: FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

      trojanflawedammyy

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks