S0381: FlawedAmmyy
FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for FlawedAmmyy was based on leaked source code for a version of Ammyy Admin, a remote access software.[1]
Security context for executives and security teams
FlawedAmmyy matters because it is a Windows remote access tool derived from leaked Ammyy Admin source code and mapped to a broad set of post-compromise behaviors: command execution, discovery, collection, persistence, C2, exfiltration, and stealth. For leaders, the decision point is not whether a single malware name is blocked, but whether Windows endpoint, identity, and network controls can expose RAT-style activity that blends remote administration, web-based C2, keylogging, screenshots, clipboard access, and file movement.
Executive priority
Treat FlawedAmmyy as a validation case for operational resilience against criminal remote access tooling. ATT&CK relationships associate it with FIN6 and TA505, both cyber criminal groups, so the relevant business questions are: can the SOC identify suspicious remote-control behavior on Windows endpoints, can incident responders determine what data or credentials may have been collected, and can audit evidence show coverage for persistence, command execution, C2, and exfiltration patterns rather than only known file indicators? This is especially material where Windows systems support payment, retail, hospitality, or other sensitive operations, but local exposure must be confirmed from environment evidence.
Technical view
The object is Windows malware with no official ATT&CK detection text, so detection engineering should pivot from the software name to its mapped techniques. Validate telemetry for PowerShell, cmd.exe, WMI, msiexec.exe, rundll32.exe, Registry Run Keys/Startup Folder, suspicious file deletion, tool transfer, local data access, user/group/system/security-software discovery, screen capture, clipboard access, keylogging-related behaviors, and C2 over web protocols with obfuscation or symmetric cryptography. IR playbooks should assume a RAT-style investigation scope: identify execution chain, persistence, operator activity, collected local data, credential exposure from input capture/keylogging, and possible exfiltration over the same C2 channel.
Likely telemetry
- Windows endpoint process creation and command-line logging for PowerShell, Windows Command Shell, WMI, msiexec.exe, and rundll32.exe
- Windows registry and startup folder monitoring for Run Key persistence
- Endpoint file creation, modification, transfer, and deletion events
- Network proxy, DNS, firewall, and EDR network connection telemetry for web-protocol C2, obfuscated traffic, encrypted/symmetric C2 patterns, and exfiltration over C2
- Windows security and system logs showing user, local group, system, peripheral, and security software discovery activity
Detection direction
- Build behavior-based detections around the related ATT&CK techniques rather than relying only on the malware family name, because the official object provides no detection guidance.
- Correlate suspicious execution utilities with follow-on discovery, persistence, collection, and outbound web traffic to reduce false positives from legitimate administration tools.
- Tune carefully for PowerShell, WMI, msiexec.exe, and rundll32.exe because they are legitimate Windows components; prioritize unusual parent-child processes, uncommon command lines, remote/network-sourced payloads, and execution followed by C2 or persistence.
- Validate whether network monitoring can distinguish normal web traffic from anomalous C2 patterns, including obfuscated or encrypted content and unusual destinations, without assuming decryption is available.
- Include collection-focused detections for screenshots, clipboard access, local file staging, and keylogging indicators, since these behaviors drive credential and data-loss risk.
Mitigation priorities
- Prioritize Windows endpoint hardening and least-privilege controls that reduce unauthorized remote execution and persistence opportunities.
- Restrict and monitor administrative scripting and living-off-the-land binaries such as PowerShell, WMI, msiexec.exe, and rundll32.exe according to business need.
- Harden persistence surfaces by monitoring and controlling Registry Run Keys and startup folders.
- Strengthen egress controls and network visibility for web-protocol outbound traffic, especially from systems that should not initiate broad external connections.
- Protect credentials by reducing interactive use of privileged accounts on exposed endpoints and investigating any evidence of input capture or keylogging as a credential-compromise event.
Additional notes and limits
ATT&CK identifies FlawedAmmyy as a RAT first seen in early 2016 and based on leaked Ammyy Admin source code. The supplied relationships map it to many behaviors across execution, persistence, discovery, collection, command-and-control, exfiltration, and stealth. The strongest defensive value is using this object as a coverage test for RAT tradecraft on Windows endpoints and for SOC correlation across host and network telemetry.
The official ATT&CK object provides no detection text, no aliases, and no explicit malware-level tactics. The take above is limited to the supplied Windows platform, official description, external references, and relationship mappings. Local prevalence, active exploitation, specific indicators, business impact, and detection efficacy require environment-specific evidence.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
FlawedAmmyy
FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for FlawedAmmyy was based on leaked source code for a version of Ammyy Admin, a remote access software.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1059.003 | Windows Command ShellSub-technique | FlawedAmmyy has used `cmd` to execute commands on a compromised host.[3] |
| Enterprise | T1082 | System Information Discovery | FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.[1] |
| Enterprise | T1056.001 | KeyloggingSub-technique | FlawedAmmyy can collect keyboard events.[3] |
| Enterprise | T1033 | System Owner/User Discovery | FlawedAmmyy enumerates the current user during the initial infection.[1][3] |
| Enterprise | T1047 | Windows Management Instrumentation | FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.[1] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.[3] |
| Enterprise | T1059.001 | PowerShellSub-technique | FlawedAmmyy has used PowerShell to execute commands.[3] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | FlawedAmmyy will attempt to detect anti-virus products during the initial infection.[1] |
| Enterprise | T1218.011 | Rundll32Sub-technique | FlawedAmmyy has used `rundll32` for execution.[3] |
| Enterprise | T1120 | Peripheral Device Discovery | FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.[1] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | FlawedAmmyy has used HTTP for C2.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | FlawedAmmyy has sent data collected from a compromised host to its C2 servers.[3] |
| Enterprise | T1113 | Screen Capture | FlawedAmmyy can capture screenshots.[3] |
| Enterprise | T1105 | Ingress Tool Transfer | FlawedAmmyy can transfer files from C2.[3] |
| Enterprise | T1056 | Input Capture | FlawedAmmyy can collect mouse events.[3] |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | FlawedAmmyy has used SEAL encryption during the initial C2 handshake.[1] |
| Enterprise | T1005 | Data from Local System | FlawedAmmyy has collected information and files from a compromised machine.[3] |
| Enterprise | T1115 | Clipboard Data | FlawedAmmyy can collect clipboard data.[3] |
| Enterprise | T1001 | Data Obfuscation | FlawedAmmyy may obfuscate portions of the initial C2 handshake.[1] |
| Enterprise | T1218.007 | MsiexecSub-technique | FlawedAmmyy has been installed via `msiexec.exe`.[3] |
| Enterprise | T1070.004 | File DeletionSub-technique | FlawedAmmyy can execute batch scripts to delete files.[3] |
| Enterprise | T1069.001 | Local GroupsSub-technique | FlawedAmmyy enumerates the privilege level of the victim during the initial infection.[1][3] |
Groups, software, and campaigns
G0037: FIN6
G0092: TA505
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 3db6a32c4729… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [2]Visa FIN6 Feb 2019
Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.
Open source URL - [3]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [4]Trend Micro TA505 June 2019
Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
Open source URL - [5]Proofpoint TA505 October 2019
Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
Open source URL - [6]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [7]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [8]mitre-attackS0381Open source URL
- [9]mitre-attackS0381Open source URL
- [10]mitre-attackS0381Open source URL
- [11]Visa FIN6 Feb 2019
Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.
Open source URL - [12]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [13]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [14]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [15]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [16]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [17]Proofpoint TA505 October 2019
Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
Open source URL - [18]Trend Micro TA505 June 2019
Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
Open source URL - [19]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [20]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [21]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [22]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [23]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [24]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [25]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [26]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [27]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [28]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [29]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [30]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [31]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [32]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [33]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [34]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [35]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [36]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [37]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [38]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [39]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [40]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [41]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [42]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [43]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [44]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [45]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [46]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [47]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [48]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [49]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [50]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [51]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [52]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL - [53]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [54]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [55]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [56]Proofpoint TA505 Mar 2018
Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.