Last seven days
- First activity
- Jul 23, 2026
- Last activity
- Jul 23, 2026
- Feed role
- C2
- Host form
- 3 IP / 0 hostnames
Malware family
FlawedAmmyy
FlawedAmmyy is a remote access Trojan (RAT) discovered by Proofpoint and used since at least early 2016 in both highly targeted email attacks and large-scale malspam campaigns.
Profile source: Mallory opens in a new tabFlawedAmmyy
Family profile
FlawedAmmyy is a remote access Trojan (RAT) discovered by Proofpoint and used since at least early 2016 in both highly targeted email attacks and large-scale malspam campaigns. It is based on leaked source code from Version 3 of the Ammyy Admin remote desktop software. Reported capabilities include remote desktop control, file system management, proxy support, audio chat, screenshot capture, clipboard collection, keylogging, command execution via PowerShell, and exfiltration of collected data to command-and-control (C2) servers. During initial profiling it enumerates the current user, leverages WMI to identify installed antivirus products, and checks whether a usable smart card is inserted in a reader. FlawedAmmyy communicates with C2 over HTTP on port 443; Proofpoint reported that its initial handshake uses SEAL-encrypted data, after which the malware sends host profiling information including OS version, privilege level, username, computer name, antivirus product, smart-card presence, and malware build time. Observed delivery vectors include macro-enabled Microsoft Word and Excel attachments, ZIP archives containing .url Internet Shortcut files that retrieved JavaScript over SMB, and infection chains involving Quant Loader and Get2 as intermediate downloaders. Proofpoint associated major FlawedAmmyy distribution activity with TA505, including Japan-focused campaigns and broader mass-email operations; targeted activity included the automotive sector. Additional observed execution details include installation via msiexec.exe. Reported infrastructure and payload indicators from Proofpoint include C2 endpoints 179.60.146.3:443 and 194.165.16.11:443, SMB URL file://buyviagraoverthecounterusabb.net/documents/B123456789012.js, Quant Loader URL hxxp://wassronledorhad.in/q2/index.php, and payload URL hxxp://balzantruck.com/45rt.exe.
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
3 Jul 23
Observed infrastructure
Leading locations
- DE3
Leading providers
- Hetzner Online GmbH3
Infrastructure traits
- Hosting 3
Samples
Recent associated samples
Reported operators
Threat actors
1 named in public reportingGet2 was, in turn, observed downloading FlawedGrace, FlawedAmmyy, Snatch, and SDBbot (a new RAT) as secondary payloads.
MITRE ATT&CK
FlawedAmmyy in ATT&CK
37 distinct techniquesTechniques
37 techniques T1082 System Information Discovery T1547.001 Registry Run Keys / Startup Folder T1518.001 Security Software Discovery T1120 Peripheral Device Discovery T1071.001 Web Protocols T1115 Clipboard Data T1033 System Owner/User Discovery T1105 Ingress Tool Transfer T1059.005 Visual Basic T1059.007 JavaScript T1566 Phishing T1204 User Execution T1566.001 Spearphishing Attachment T1219 Remote Access Tools T1057 Process Discovery T1021.002 SMB/Windows Admin Shares T1071 Application Layer Protocol T1204.002 Malicious File T1497.001 System Checks T1059.003 Windows Command Shell T1005 Data from Local System T1112 Modify Registry T1059.001 PowerShell T1041 Exfiltration Over C2 Channel T1518 Software Discovery T1047 Windows Management Instrumentation T1070.004 File Deletion T1036 Masquerading T1218.007 Msiexec T1573.001 Symmetric Cryptography T1137.001 Office Template Macros T1113 Screen Capture T1056.001 Keylogging T1218.011 Rundll32 T1069.001 Local Groups T1056 Input Capture T1001 Data Obfuscation
