FlawedAmmyy

FlawedAmmyy is a Windows remote access trojan derived from leaked source code of the legitimate Ammyy Admin remote-administration tool and first observed in 2016. It is a full-featured RAT used in financially motivated intrusion activity, most notably by TA505, and has also been observed in delivery chains involving Necurs, Amadey, and AndroMut. It has been associated with enterprise intrusions that later led to Clop ransomware deployment, including operations targeting financial institutions, government entities, and other organizations across multiple regions.

The malware supports broad post-compromise control and collection functions. Reported capabilities include command execution through PowerShell and the Windows command shell, file upload and download, screenshot capture, clipboard collection, keylogging, mouse-event collection, host reconnaissance, and exfiltration over its command-and-control channel. During initial execution it can enumerate the current user, privilege level, operating system, computer name, and installed antivirus products, including via Windows Management Instrumentation, and it can check for smart-card presence. FlawedAmmyy has used HTTP for command and control and has been observed using SEAL encryption and handshake obfuscation during initial communications.

Persistence has been established through the Windows Run key, and execution has been observed via common Windows utilities including msiexec and rundll32. The malware has also been reported deleting files through batch-script execution as part of cleanup or defense-evasion behavior. In some campaigns, FlawedAmmyy was delivered through phishing-driven infection chains using malicious Office documents, HTML or ISO lures, macro-enabled files, MSI installers, and intermediate downloaders. TA505 notably used it as a second-stage payload in campaigns that evolved from broad email distribution into hands-on intrusions with lateral movement and eventual ransomware deployment.

FlawedAmmyy is widely regarded as one of the characteristic TA505 backdoors of the late 2010s and an important component in the group’s transition from mass-malspam operations to more targeted enterprise compromise.