FlawedAmmyy
MITRE ATT&CK: S0381 View on attack.mitre.org
Aliases: FlawedAmmyy
- First seen
- 2016-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 14 (12 malicious)
- Last IoC activity
- 2026-08-28 12:57:32
- Profile updated
- 2026-07-07 15:47:08
Targeted industries: financial-services government-and-public-sector technology-and-telecommunications
Context
FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for FlawedAmmyy was based on leaked source code for a version of Ammyy Admin, a remote access software.
Recent IoC activity
12 malicious indicators in Maltiverse are attributed to FlawedAmmyy (S0381). The 12 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | AA_v3.exe | 2026-08-28 | 2 |
| file sample | MBSetup.exe | 2026-08-18 | 1 |
| file sample | AA_v3.4.zip | 2026-05-28 | 1 |
| file sample | 2026-04-21_28e27e1c959bc303f5c6cee7b8b9636c_elex_hacktools_wannacry | 2026-04-21 | 1 |
| file sample | test.txt | 2026-04-14 | 1 |
| file sample | 2026-02-19_7092a06a5a47cb4c942dddc246f06dc4_elex_hacktools_wannacry | 2026-04-05 | 1 |
| file sample | 2026-03-27_9161638539041c790846334e3d157b6b_elex_wannacry | 2026-03-27 | 1 |
| file sample | 2026-03-05_658c6daa75bb146079700d9779b123fb_elex_hacktools_wannacry | 2026-03-05 | 1 |
| file sample | 2026-02-28_120ac18d2f836561ebd234eb8cf5bf84_elex_hacktools_wannacry | 2026-02-28 | 1 |
| file sample | 2026-02-01_066786cc1ece75a81028bd7c07e1c5e9_elex_hacktools_wannacry | 2026-02-01 | 1 |
| file sample | 40b479d2688a659e57197715395f78c1801d4ed2ff275d59149c52ec9fb01498 | 2025-11-05 | 1 |
| file sample | f02eca433cdb78186c1614b914ff4aa8da47dd430e8288ad721bd1da610f32d5 | 2025-02-14 | 1 |
Detection coverage
- 553 Sigma rules
Malware & tools used
- Windows Command Shell (attack-pattern)
- System Information Discovery (attack-pattern)
- Keylogging (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- PowerShell (attack-pattern)
- Security Software Discovery (attack-pattern)
- Rundll32 (attack-pattern)
- Peripheral Device Discovery (attack-pattern)
- Web Protocols (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Screen Capture (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Input Capture (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Data from Local System (attack-pattern)
- Clipboard Data (attack-pattern)
- Data Obfuscation (attack-pattern)
- Msiexec (attack-pattern)
- File Deletion (attack-pattern)
- Local Groups (attack-pattern)
Used by threat actors
Reports & references
- CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
- web.archive.org — Odinaff New Trojan Used High Level Financial Attacks (report)
- pwc.co.uk — Cyber Threats 2019 Retrospect (report)
- threatrecon.nshc.net — Sectorj04 Groups Increased Activity In 2019 (report)
- secureworks.com — Gold Tahoe (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 009 (report)
- fsec.or.kr — 2297.Do (report)
- npu.gov.ua — Kiberpolicziya Vikrila Xakerske Ugrupovannya U Rozpovsyudzhenni Virusu Shifruvalnika Ta Nanesenni Inozemnim Kompaniyam Piv Milyarda Dolariv Zbitkiv (report)
- blog.intel471.com — A Brief History Of Ta505 (report)
- intel471.com — A Brief History Of Ta505 (report)
- ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
- proofpoint.com — Ta505 Begins Summer Campaigns New Pet Malware Downloader Andromut Uae South (report)
- macnica.net — Mpressioncss 2018 1H Report Mnc Rev3 Nopw (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Flawedammyy (report)
- secrary.com — Ammy Rat Downloader (report)
- ptsecurity.com — Operation Ta505 (report)
- habr.com — 475328 (report)
- sans.org — Unpacking Decrypting Flawedammyy 38930 (report)
- Trend Micro — Ta505 At It Again Variety Is The Spice Of Servhelper And Flawedammyy (report)
- proofpoint.com — Ta505 Abusing Settingcontent Ms Within Pdf Files Distribute Flawedammyy Rat (report)
- youtube.com — Watch (report)
- proofpoint.com — Leaked Source Code Ammyy Admin Turned Flawedammyy Rat (report)
- MITRE ATT&CK — S0381 (report)
- proofpoint.com — Leaked Ammyy Admin Source Code Turned Malware (report)