Summary

FlawedAmmyy is a remote access Trojan (RAT) which is based on leaked Ammyy Admin software. Ammyy Admin is a popular remote access tool used by businesses and consumers to handle remote control and diagnostics on Microsoft Windows machines which makes the FlawedAmmyy RAT to exhibit the functionality of the leaked version, including remote desktop control, file system manager, proxy support and audio chat.

FlawedAmmyy was used in both massive campaigns such as phishing campaigns, to potentially create a large base of compromised computers, as well as targeted campaigns that create opportunities for actors to steal customer data, proprietary information, and more. In the latest campaign of TA505 which is a prolific Cybercriminal group known for attacks against multiple financial institutions and retail companies, they started using HTML attachments to deliver malicious .XLS files that lead to downloader and backdoor FlawedAmmyy, mostly to target South Korean users.

Upon infection, the RAT can enable potential attackers to perform a variety of malicious activities such as:

• Gain complete access to PCs’ camera and microphone
• Capture screenshots
• Access a variety of services, steal files and credentials
• Steal customer data, proprietary information and more

Capabilities

• Information Theft
• Backdoor commands

Impact

• Financial Loss - steals financial information of user
• Compromise system security - with backdoor capabilities that can execute malicious commands
• Violation of user privacy - gains complete access to camera and microphone of user

Infection Routine

File Reputation

Predictive Machine Learning

Web Reputation

Anti Spam