ammyyadmin | 7a424dd9125b68c55894e5e8a6921369138f94a1c4bedabdfead7c57cb43fa72

General

Target
2026-10-07_861dc5cac9a0251d9045970ba9917421_amadey_coinminer_darkgate_elex_hacktools_manuscrypt_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 1.4MB
Sample261008-lvax4aex2p
SHA256 7a424dd9125b68c55894e5e8a6921369138f94a1c4bedabdfead7c57cb43fa72
MD5 861dc5cac9a0251d9045970ba9917421
SHA1 4ada84f9d030f30cb05a9f2d341f590e031cff49
SHA512 98c6b0c414c7a274abed49ca4082d504864cff75029ac1f27abbfbf69ecc6106e6b88bb7f9520e38a11eafb8e55a587120050303259bc1f997ba084dad0799e8
SSDEEP 24576:1hXalj3DSudvGM3MXTVhtSQWGtxhorLkbDEhyW3XS1RtcePKUBATZxXt:1hXoBdqTDtSQWGtvKLwEhXSbBSVx9
TLSH
T19965E1137981807ED0720530896A5B75DAB6FE640F7689872388BF2C5E75E61EF23339
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_861dc5cac9a0251d9045970ba9917421_amadey_coinminer_darkgate_elex_hacktools_manuscrypt_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.4MB
- SHA256 7a424dd9125b68c55894e5e8a6921369138f94a1c4bedabdfead7c57cb43fa72
- MD5 861dc5cac9a0251d9045970ba9917421
- SHA1 4ada84f9d030f30cb05a9f2d341f590e031cff49
- SHA512 98c6b0c414c7a274abed49ca4082d504864cff75029ac1f27abbfbf69ecc6106e6b88bb7f9520e38a11eafb8e55a587120050303259bc1f997ba084dad0799e8
- SSDEEP 24576:1hXalj3DSudvGM3MXTVhtSQWGtxhorLkbDEhyW3XS1RtcePKUBATZxXt:1hXoBdqTDtSQWGtvKLwEhXSbBSVx9
- TLSH
  T19965E1137981807ED0720530896A5B75DAB6FE640F7689872388BF2C5E75E61EF23339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt defense_evasion discovery execution ammyyadmin flawedammyy ramsay framework rat rootkit spyware trojan upx
- AmmyyAdmin payload
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ammyy Admin
  Remote admin tool with various capabilities.
  rat ammyyadmin
- Family: FlawedAmmyy RAT
  Remote-access trojan based on leaked code for the Ammyy remote admin software.
  trojan flawedammyy
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2