AA_v3.exe

Classification: Malicious

AA_v3.exe is a backdoor (Windows executable, 762.1 KB). Flagged by 72% of antivirus engines (68 detections). Linked to Flawedammyy malware.

Detection summary

  • 68 antivirus detections (72% detection ratio)
  • 2 IDS alerts
  • 6 processes observed
  • 2 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: FLAWEDAMMYY (S0381)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-10-02 10:03:59 2026-10-02 10:03:59 malicious-activity
Ammyyadmin Triage 2026-03-27 18:23:23 2026-09-09 00:15:55 malicious-activity
Flawedammyy Triage 2026-03-29 18:15:46 2026-03-29 18:15:46 malicious-activity S0381 FlawedAmmyy
Generic Malware Hybrid-Analysis 2023-11-21 16:00:04 2024-10-19 00:00:35

Tags

banker emotet rootkit wanacrypt0r wannacry wcry ammyyadmin flawedammyy discovery trojan rat

Sample information

Filenames
AA_v3.exe, sub_d67c7ef1c8e2.bin, AmmyyAdmin3.6.exe, aa (2).exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
780432 bytes
MD5
e9b569f7cbf23d91df065c18f4c43840
SHA-1
5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad
SHA-256
d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605
First indexed
2023-11-21 15:35:57
Last updated
2026-09-09 11:12:17

Antivirus detections

EngineDetection
BkavW32.Common.549EF60E
LionicRiskware.Win32.Ammyy.1!c
tehtrisGeneric.Malware
ClamAVWin.Malware.Agent-6346242-0
CAT-QuickHealHackTool.Win32CiR
SkyhighRemAdm-Ammyy
ALYacGen:Variant.Application.RemoteAdmin.6
Cylanceunsafe
ZillyaTrojan.GenericKD.Win32.100289
CrowdStrikewin/grayware_confidence_100% (W)
BitDefenderGen:Variant.Application.RemoteAdmin.6
K7GWUnwanted-Program ( 004b889d1 )
K7AntiVirusUnwanted-Program ( 004b889d1 )
ArcabitTrojan.Application.RemoteAdmin.6
SymantecRemacc.Ammyy
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/RemoteAdmin.Ammyy.B potentially unsafe
APEXMalicious
CynetMalicious (score: 100)
Kasperskynot-a-virus:RemoteAdmin.Win32.Ammyy.xrp
NANO-AntivirusRiskware.Win32.RemoteAdmin.euxmxo
MicroWorld-eScanGen:Variant.Application.RemoteAdmin.6
TencentMalware.Win32.Gencirc.117eaf1e
SophosGeneric Reputation PUA (PUA)
F-SecurePrivacyRisk.SPR/Tool.Monitor.A
DrWebProgram.RemoteAdmin.701
VIPREGen:Variant.Application.RemoteAdmin.6
TrendMicroHKTL_AMMYADMN.GB
FireEyeGeneric.mg.e9b569f7cbf23d91
EmsisoftGen:Variant.Application.RemoteAdmin.6 (B)
SentinelOneStatic AI - Suspicious PE
JiangminRemoteAdmin.Ammyy.ey
WebrootW32.Ammyy.Wrj
VaristW32/RemoteAdmin.C.gen!Eldorado
AviraSPR/Tool.Monitor.A
Antiy-AVLTrojan/Win32.TSGeneric
GridinsoftRisk.Win32.RemoteAdmin.vl!c
XcitiumApplication.Win32.RemoteAdmin.Ammyy.CA@6lncg7
MicrosoftPUA:Win32/Presenoker
ZoneAlarmnot-a-virus:RemoteAdmin.Win32.Ammyy.xrp
GDataWin32.Riskware.RemoteAdmin.A
GoogleDetected
AhnLab-V3Unwanted/Win32.RemoteAdmin.R218311
McAfeeRemAdm-Ammyy
MAXmalware (ai score=99)
DeepInstinctMALICIOUS
MalwarebytesPUP.Optional.Ammyy
ZonerTrojan.Win32.64955
TrendMicro-HouseCallHKTL_AMMYADMN.GB
Rising[email protected] (RDMK:NnHcWsBywxBRZ5FK1UIYew)
YandexTrojan.Igent.bRTS45.2
FortinetRiskware/RemoteAdmin_Ammyy
AVGFileRepPup [PUP]
Antiy-AVLRiskWare[RemoteAdmin]/Win32.Ammyy
AvastFileRepPup [PUP]
CTXexe.remote-access-trojan.ammyy
CylanceUnsafe
Kingsoftmalware.kb.a.994
MaxSecureVirus.Trojan.Ammyy.wrj
McAfeeDti!D67C7EF1C8E2
MicrosoftPUA:Win32/DriverToolkit
RisingTrojan.Bitrep!8.F596 (RDMK:cmRtazoAMYPyeuLco8b6r0SlDSYQ)
SentinelOneStatic AI - Malicious PE
huorongHackTool/AmmyyAdmin.a
KingsoftWin32.HACKTOOL.RemoteAdmin.v
MaxSecureTrojan.Malware.153909945.susgen
TrellixENSRemAdm-Ammyy
alibabacloudBackdoor[rat]:Win/RemoteAdmin.Atncz

Network contacts

188.42.129.148 136.243.104.235

DNS requests

rl.ammyy.com

Process list

NameCommand line
aa_2_.exe
aa_2_.exe-service -lunch
aa_2_.exe
AA_v3.exe
AA_v3.exe-service -lunch
AA_v3.exe