FlawedAmmyy

Malware & Tools · FlawedAmmyy

· MalwareS0381 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for FlawedAmmyy was based on leaked source code for a version of Ammyy Admin, a remote access software.(Citation: Proofpoint TA505 Mar 2018)

Tactic Coverage

collection (5)discovery (5)command and control (4)execution (3)stealth (3)credential access (2)exfiltration (1)persistence (1)privilege escalation (1)

Used By (2 groups)

G0037FIN6Magecart Group 6, ITG08 G0092TA505Hive0065, Spandex Tempest

Techniques (22)

T1001Data Obfuscation

command and control

T1005Data from Local System

collection

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1047Windows Management Instrumentation

execution

T1056Input Capture

collectioncredential access

References

https://attack.mitre.org/software/S0381 https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware