SYMBOLCOMMON_NAMEaka. SYNONYMS
win.flawedammyy (Back to overview)

FlawedAmmyy

Actor(s): TA505

VTCollection     URLhaus        

FlawedAmmyy is a well-known Remote Access Tool (RAT) attributed to criminal gang TA505 and used to get the control of target machines. The name reminds the strong link with the leaked source code of Ammyy Admin from which it took the main structure.

References
2021-06-16Національної поліції УкраїниНаціональна поліція України
Cyberpolice exposes hacker group in spreading encryption virus and causing half a billion dollars in damage to foreign companies
Clop Cobalt Strike FlawedAmmyy
2020-08-20CERT-FRCERT-FR
Development of the Activity of the TA505 Cybercriminal Group
AndroMut Bart Clop Dridex FlawedAmmyy FlawedGrace Get2 Locky Marap QuantLoader SDBbot ServHelper tRat TrickBot
2020-05-21Intel 471Intel 471
A brief history of TA505
AndroMut Bart Dridex FlawedAmmyy FlawedGrace Gandcrab Get2 GlobeImposter Jaff Kegotip Locky Necurs Philadephia Ransom Pony QuantLoader Rockloader SDBbot ServHelper Shifu Snatch TrickBot
2020-05-20PTSecurityPT ESC Threat Intelligence
Operation TA505: how we analyzed new tools from the creators of the Dridex trojan, Locky ransomware, and Neutrino botnet
FlawedAmmyy
2020-03-04CrowdStrikeCrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03PWC UKPWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-02-28Financial Security InstituteFinancial Security Institute
Profiling of TA505 Threat Group That Continues to Attack the Financial Sector
Amadey Clop FlawedAmmyy Rapid Ransom SDBbot TinyMet
2020-02-13QianxinQi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020-01-01SecureworksSecureWorks
GOLD TAHOE
Clop FlawedAmmyy FlawedGrace Get2 SDBbot ServHelper TA505
2019-08-29ThreatReconThreatRecon Team
SectorJ04 Group’s Increased Activity in 2019
FlawedAmmyy ServHelper TA505
2019-08-27Trend MicroHara Hiroaki, Jaromír Hořejší, Loseway Lu
TA505 At It Again: Variety is the Spice of ServHelper and FlawedAmmyy
FlawedAmmyy ServHelper
2019-07-02ProofpointDennis Schwarz, Matthew Mesa, Proofpoint Threat Insight Team
TA505 begins summer campaigns with a new pet malware downloader, AndroMut, in the UAE, South Korea, Singapore, and the United States
AndroMut FlawedAmmyy
2019-05-31Youtube (0verfl0w_)0verfl0w_
Defeating Commercial and Custom Packers like a Pro - VMProtect, ASPack, PECompact, and more
FlawedAmmyy Ramnit
2019-05-28MITREMITRE
FlawedAmmyy
FlawedAmmyy
2019-04-22SANSMike Downey
Unpacking & Decrypting FlawedAmmyy
FlawedAmmyy
2018-10-01Macnica NetworksMacnica Networks
Trends in cyber espionage (targeted attacks) targeting Japan | First half of 2018
Anel Cobalt Strike Datper FlawedAmmyy Quasar RAT RedLeaves taidoor Winnti xxmm
2018-07-19ProofpointProofpoint Staff
TA505 Abusing SettingContent-ms within PDF files to Distribute FlawedAmmyy RAT
FlawedAmmyy
2018-06-28Secrary BlogLasha Khasaia
A Brief Overview of the AMMYY RAT Downloader
FlawedAmmyy
2018-03-07ProofpointProofpoint Staff
Leaked Ammyy Admin Source Code Turned into Malware
FlawedAmmyy QuantLoader
2016-10-11SymantecSymantec Security Response
Odinaff: New Trojan used in high level financial attacks
Batel FlawedAmmyy Odinaff RMS FIN7
Yara Rules
[TLP:WHITE] win_flawedammyy_auto (20230808 | Detects win.flawedammyy.)
rule win_flawedammyy_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.flawedammyy."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0000 0404 0404 0404 0401 }
            // n = 5, score = 200
            //   0000                 | add                 byte ptr [eax], al
            //   0404                 | add                 al, 4
            //   0404                 | add                 al, 4
            //   0404                 | add                 al, 4
            //   0401                 | add                 al, 1

        $sequence_1 = { 8bc4 83ec10 660fd600 f30f7e45ac }
            // n = 4, score = 200
            //   8bc4                 | mov                 eax, esp
            //   83ec10               | sub                 esp, 0x10
            //   660fd600             | movq                qword ptr [eax], xmm0
            //   f30f7e45ac           | movq                xmm0, qword ptr [ebp - 0x54]

        $sequence_2 = { 00b3854200e5 854200 37 864200 }
            // n = 4, score = 200
            //   00b3854200e5         | add                 byte ptr [ebx - 0x1affbd7b], dh
            //   854200               | test                dword ptr [edx], eax
            //   37                   | aaa                 
            //   864200               | xchg                byte ptr [edx], al

        $sequence_3 = { 8d85bcfcffff 68???????? 50 ffd3 68dff0f081 6a01 e8???????? }
            // n = 7, score = 200
            //   8d85bcfcffff         | lea                 eax, [ebp - 0x344]
            //   68????????           |                     
            //   50                   | push                eax
            //   ffd3                 | call                ebx
            //   68dff0f081           | push                0x81f0f0df
            //   6a01                 | push                1
            //   e8????????           |                     

        $sequence_4 = { ffd6 8d8594f3ffff 50 68???????? 68???????? }
            // n = 5, score = 200
            //   ffd6                 | call                esi
            //   8d8594f3ffff         | lea                 eax, [ebp - 0xc6c]
            //   50                   | push                eax
            //   68????????           |                     
            //   68????????           |                     

        $sequence_5 = { 004bbf 42 0062bf 42 }
            // n = 4, score = 200
            //   004bbf               | add                 byte ptr [ebx - 0x41], cl
            //   42                   | inc                 edx
            //   0062bf               | add                 byte ptr [edx - 0x41], ah
            //   42                   | inc                 edx

        $sequence_6 = { 0039 e342 0048e3 42 }
            // n = 4, score = 200
            //   0039                 | add                 byte ptr [ecx], bh
            //   e342                 | jecxz               0x44
            //   0048e3               | add                 byte ptr [eax - 0x1d], cl
            //   42                   | inc                 edx

        $sequence_7 = { ff05???????? f7460c0c010000 7554 833cbd7cae410000 53 }
            // n = 5, score = 200
            //   ff05????????         |                     
            //   f7460c0c010000       | test                dword ptr [esi + 0xc], 0x10c
            //   7554                 | jne                 0x56
            //   833cbd7cae410000     | cmp                 dword ptr [edi*4 + 0x41ae7c], 0
            //   53                   | push                ebx

        $sequence_8 = { 8d85bcfdffff 50 ffd3 8b45fc 80384d 0f85a7000000 8078015a }
            // n = 7, score = 200
            //   8d85bcfdffff         | lea                 eax, [ebp - 0x244]
            //   50                   | push                eax
            //   ffd3                 | call                ebx
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   80384d               | cmp                 byte ptr [eax], 0x4d
            //   0f85a7000000         | jne                 0xad
            //   8078015a             | cmp                 byte ptr [eax + 1], 0x5a

        $sequence_9 = { e8???????? 53 8d85c0fdffff 50 56 e8???????? }
            // n = 6, score = 200
            //   e8????????           |                     
            //   53                   | push                ebx
            //   8d85c0fdffff         | lea                 eax, [ebp - 0x240]
            //   50                   | push                eax
            //   56                   | push                esi
            //   e8????????           |                     

        $sequence_10 = { 0018 874200 58 874200 }
            // n = 4, score = 200
            //   0018                 | add                 byte ptr [eax], bl
            //   874200               | xchg                dword ptr [edx], eax
            //   58                   | pop                 eax
            //   874200               | xchg                dword ptr [edx], eax

        $sequence_11 = { 8b35???????? 8d85a0f6ffff 50 8d85a8f8ffff }
            // n = 4, score = 200
            //   8b35????????         |                     
            //   8d85a0f6ffff         | lea                 eax, [ebp - 0x960]
            //   50                   | push                eax
            //   8d85a8f8ffff         | lea                 eax, [ebp - 0x758]

        $sequence_12 = { 002a e342 0039 e342 }
            // n = 4, score = 200
            //   002a                 | add                 byte ptr [edx], ch
            //   e342                 | jecxz               0x44
            //   0039                 | add                 byte ptr [ecx], bh
            //   e342                 | jecxz               0x44

        $sequence_13 = { 8bf0 ff5208 85f6 0f8818feffff ff7508 8d4df0 e8???????? }
            // n = 7, score = 200
            //   8bf0                 | mov                 esi, eax
            //   ff5208               | call                dword ptr [edx + 8]
            //   85f6                 | test                esi, esi
            //   0f8818feffff         | js                  0xfffffe1e
            //   ff7508               | push                dword ptr [ebp + 8]
            //   8d4df0               | lea                 ecx, [ebp - 0x10]
            //   e8????????           |                     

        $sequence_14 = { 0022 8a4200 828a4200bb8a42 00ff }
            // n = 4, score = 200
            //   0022                 | add                 byte ptr [edx], ah
            //   8a4200               | mov                 al, byte ptr [edx]
            //   828a4200bb8a42       | or                  byte ptr [edx - 0x7544ffbe], 0x42
            //   00ff                 | add                 bh, bh

        $sequence_15 = { 0062bf 42 0079bf 42 }
            // n = 4, score = 200
            //   0062bf               | add                 byte ptr [edx - 0x41], ah
            //   42                   | inc                 edx
            //   0079bf               | add                 byte ptr [ecx - 0x41], bh
            //   42                   | inc                 edx

        $sequence_16 = { ff15???????? 8b75d8 e9???????? 8d85d0feffff 68???????? 50 ff15???????? }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b75d8               | mov                 esi, dword ptr [ebp - 0x28]
            //   e9????????           |                     
            //   8d85d0feffff         | lea                 eax, [ebp - 0x130]
            //   68????????           |                     
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_17 = { 8b46f8 834de4ff 49 c745e8ff000000 8b3c857c303400 c745ecffff0000 0faff9 }
            // n = 7, score = 100
            //   8b46f8               | mov                 eax, dword ptr [esi - 8]
            //   834de4ff             | or                  dword ptr [ebp - 0x1c], 0xffffffff
            //   49                   | dec                 ecx
            //   c745e8ff000000       | mov                 dword ptr [ebp - 0x18], 0xff
            //   8b3c857c303400       | mov                 edi, dword ptr [eax*4 + 0x34307c]
            //   c745ecffff0000       | mov                 dword ptr [ebp - 0x14], 0xffff
            //   0faff9               | imul                edi, ecx

        $sequence_18 = { 4e 48 75f7 68???????? 57 ff15???????? }
            // n = 6, score = 100
            //   4e                   | dec                 esi
            //   48                   | dec                 eax
            //   75f7                 | jne                 0xfffffff9
            //   68????????           |                     
            //   57                   | push                edi
            //   ff15????????         |                     

        $sequence_19 = { 8bdf 8b06 83661c00 83f807 0f87c9000000 ff248580233400 }
            // n = 6, score = 100
            //   8bdf                 | mov                 ebx, edi
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   83661c00             | and                 dword ptr [esi + 0x1c], 0
            //   83f807               | cmp                 eax, 7
            //   0f87c9000000         | ja                  0xcf
            //   ff248580233400       | jmp                 dword ptr [eax*4 + 0x342380]

        $sequence_20 = { 8b46f8 8b04855c303400 c1e002 50 6a40 }
            // n = 5, score = 100
            //   8b46f8               | mov                 eax, dword ptr [esi - 8]
            //   8b04855c303400       | mov                 eax, dword ptr [eax*4 + 0x34305c]
            //   c1e002               | shl                 eax, 2
            //   50                   | push                eax
            //   6a40                 | push                0x40

        $sequence_21 = { 8b4ef8 83f907 0f8781000000 ff248dfd243400 }
            // n = 4, score = 100
            //   8b4ef8               | mov                 ecx, dword ptr [esi - 8]
            //   83f907               | cmp                 ecx, 7
            //   0f8781000000         | ja                  0x87
            //   ff248dfd243400       | jmp                 dword ptr [ecx*4 + 0x3424fd]

        $sequence_22 = { 7330 ff75f8 ff15???????? 81c600040000 6a42 56 }
            // n = 6, score = 100
            //   7330                 | jae                 0x32
            //   ff75f8               | push                dword ptr [ebp - 8]
            //   ff15????????         |                     
            //   81c600040000         | add                 esi, 0x400
            //   6a42                 | push                0x42
            //   56                   | push                esi

        $sequence_23 = { eb0e 8b14957c303400 49 0fafd1 0155fc }
            // n = 5, score = 100
            //   eb0e                 | jmp                 0x10
            //   8b14957c303400       | mov                 edx, dword ptr [edx*4 + 0x34307c]
            //   49                   | dec                 ecx
            //   0fafd1               | imul                edx, ecx
            //   0155fc               | add                 dword ptr [ebp - 4], edx

        $sequence_24 = { 83f937 7f2a 8d44c1d0 0fbe0a }
            // n = 4, score = 100
            //   83f937               | cmp                 ecx, 0x37
            //   7f2a                 | jg                  0x2c
            //   8d44c1d0             | lea                 eax, [ecx + eax*8 - 0x30]
            //   0fbe0a               | movsx               ecx, byte ptr [edx]

        $sequence_25 = { 33db 83f855 0f872affffff 0fb6805a213400 ff2485f6203400 8b8614080000 }
            // n = 6, score = 100
            //   33db                 | xor                 ebx, ebx
            //   83f855               | cmp                 eax, 0x55
            //   0f872affffff         | ja                  0xffffff30
            //   0fb6805a213400       | movzx               eax, byte ptr [eax + 0x34215a]
            //   ff2485f6203400       | jmp                 dword ptr [eax*4 + 0x3420f6]
            //   8b8614080000         | mov                 eax, dword ptr [esi + 0x814]

        $sequence_26 = { 56 8a0a 80f930 7569 }
            // n = 4, score = 100
            //   56                   | push                esi
            //   8a0a                 | mov                 cl, byte ptr [edx]
            //   80f930               | cmp                 cl, 0x30
            //   7569                 | jne                 0x6b

        $sequence_27 = { 395d08 88987830ca01 0f8484010000 ff75fc 8b35???????? ffd6 f6450802 }
            // n = 7, score = 100
            //   395d08               | cmp                 dword ptr [ebp + 8], ebx
            //   88987830ca01         | mov                 byte ptr [eax + 0x1ca3078], bl
            //   0f8484010000         | je                  0x18a
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   8b35????????         |                     
            //   ffd6                 | call                esi
            //   f6450802             | test                byte ptr [ebp + 8], 2

        $sequence_28 = { 50 e8???????? ff75ac 8b3d???????? ffd7 ff75a8 ffd7 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   e8????????           |                     
            //   ff75ac               | push                dword ptr [ebp - 0x54]
            //   8b3d????????         |                     
            //   ffd7                 | call                edi
            //   ff75a8               | push                dword ptr [ebp - 0x58]
            //   ffd7                 | call                edi

        $sequence_29 = { ff248580233400 832700 e9???????? 55 e8???????? eb1a }
            // n = 6, score = 100
            //   ff248580233400       | jmp                 dword ptr [eax*4 + 0x342380]
            //   832700               | and                 dword ptr [edi], 0
            //   e9????????           |                     
            //   55                   | push                ebp
            //   e8????????           |                     
            //   eb1a                 | jmp                 0x1c

        $sequence_30 = { 895df0 ffd6 53 ff75dc 6813100000 ff35???????? }
            // n = 6, score = 100
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   ffd6                 | call                esi
            //   53                   | push                ebx
            //   ff75dc               | push                dword ptr [ebp - 0x24]
            //   6813100000           | push                0x1013
            //   ff35????????         |                     

        $sequence_31 = { 0f8781000000 ff248dfd243400 881f eb76 }
            // n = 4, score = 100
            //   0f8781000000         | ja                  0x87
            //   ff248dfd243400       | jmp                 dword ptr [ecx*4 + 0x3424fd]
            //   881f                 | mov                 byte ptr [edi], bl
            //   eb76                 | jmp                 0x78

    condition:
        7 of them and filesize < 1350656
}
Download all Yara Rules