MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FlawedAmmyy


Vendor detections: 5


Intelligence 5 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9
SHA3-384 hash: e470c9a8bd60228d081a454a3493ae57c50f86017ebee672263a8114b004c727ca229f3834f421f872bfb652b5c02dc9
SHA1 hash: 6f3500c343c7ec13e7ab3b304df735a0b96f29a3
MD5 hash: ff139aa66d20be99c34f5e9daec7726b
humanhash: lion-echo-single-august
File name:PaymentProf.zip
Download: download sample
Signature FlawedAmmyy
Create hunting rule
File size:8'047'834 bytes
First seen:2023-09-06 10:37:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: 12345
ssdeep 196608:OzRuAFSr+5tgeTsg+Jlegqf6oxDUX2Wj3JoNzr:OzDFsugkl+SpxD2ZUzr
TLSH T1B2863355326EC96F4C093E61032D89920ED2557F6B3423C673F6390E8A466960FDBFCA
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter JAMESWT_WT
Tags:ammy FlawedAmmyy newstte-giize-com pw-12345 zip


Avatar
JAMESWT_WT
from https://247info.]click related to screenconnect / connectwise
this time #ammy https://247info].click/PaymentProf.zip (zip password 12345) newstte.giize.]com:2727

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
IT IT
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PaymentProofsigned.exe
File size:8'404'280 bytes
SHA256 hash: c4c0df629f8dbb15bf56089c1bb1f31e4fcc485376ec771942a997bb1654ee9b
MD5 hash: 302ed52d9459e06cc2d4b81de0e2295c
MIME type:application/x-dosexec
Signature FlawedAmmyy
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs3369.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlyqsrsjccx3rro4bypdyr6fr23nitd4xynrylinyklzz5oll2uq._file
Result
Malware family:
ammyyadmin
Create hunting rule
Score:
  10/10
Tags:
family:ammyyadmin persistence rat
Link:
https://tria.ge/reports/230906-qacy6sfe56/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Creates new service(s)
AmmyyAdmin payload
Ammyy Admin
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ammyy_Admin_AA_v3
Create hunting rule
Author:Florian Roth
Description:Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe
Reference:http://goo.gl/gkAg2E
Rule name:CN_Actor_AmmyyAdmin
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Ammyy Admin Downloader
Reference:Internal Research - CN Actor
Rule name:CN_Actor_AmmyyAdmin_RID2E4F
Create hunting rule
Author:Florian Roth
Description:Detects Ammyy Admin Downloader
Reference:Internal Research - CN Actor
Rule name:CN_Actor_RA_Tool_Ammyy_mscorsvw
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Ammyy remote access tool
Reference:Internal Research - CN Actor
Rule name:CN_Actor_RA_Tool_Ammyy_mscorsvw_RID3338
Create hunting rule
Author:Florian Roth
Description:Detects Ammyy remote access tool
Reference:Internal Research - CN Actor
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FlawedAmmyy

zip 8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2710008/
  
Delivery method
Distributed via web download

Comments