FlawedAmmyy

Malware Profile Updated 3 months ago

Download STIX

Preview STIX

FlawedAmmyy is a notable malware, specifically a Remote Access Trojan (RAT), that has been leveraged by threat actors for malicious purposes. The malware is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites unbeknownst to the user. Once inside, FlawedAmmyy can steal personal information, disrupt operations, or even hold data hostage for ransom. Notably, it was observed being downloaded as a secondary payload by Get2, another malware, alongside other harmful programs like FlawedGrace, Snatch, and SDBbot. The Cl0p threat actor group has been particularly associated with the use of FlawedAmmyy, using this RAT to communicate with their Command and Control (C2) infrastructure. This enables them to control infected devices remotely and download additional malware components. In addition to FlawedAmmyy, Cl0p is known to utilize other tools such as the Cobalt Strike post-exploitation tool, web shells like DEWMODE and LEMURLOOT, and SDBot. In recent campaigns, the TA505 group has also made significant use of FlawedAmmyy, turning it from a regionally-focused malware into a global threat. They have notably abused Microsoft Excel Web Query files (.iqy attachments) to download FlawedAmmyy onto unsuspecting users' systems. A series of these campaigns were observed in late April and May, with the most recent one occurring on June 7. These incidents underscore the ongoing risk posed by FlawedAmmyy and the need for robust cybersecurity measures to counter it.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Lemurloot	1	LemurLoot is a malicious software, or malware, specifically a web shell written in C# that targets the MOVEit Transfer platform. It was developed and deployed by the CL0P ransomware group to exploit vulnerabilities in systems and steal data. In May 2023, the group exploited a SQL injection zero-day

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Trojan

Payload

Rat

Cobalt Strike

Loader Malware

Exploit

Loader

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Clop	Unspecified	3	Clop is a notorious malware, short for malicious software, known for its disruptive and damaging effects on computer systems. It primarily infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, Clop can steal personal information, disrupt o
Get2	Unspecified	1	Get2 is a type of malware, harmful software designed to infiltrate and damage computer systems or devices. It can be unknowingly downloaded through suspicious emails, downloads, or websites, enabling it to steal personal information, disrupt operations, or hold data hostage for ransom. Among the mos
SDBbot	Unspecified	1	SDBbot is a malicious software (malware) that infiltrates computer systems typically through deceptive downloads, emails, or websites. In the context of cyber threats, it falls under the category of custom malware, used by threat groups such as GOLD TAHOE. Other common offensive security tools and c
FlawedGrace	Unspecified	1	FlawedGrace is a notorious malware, a remote access trojan (RAT), that has been used extensively in cyberattacks. It was first brought to light in June 2023 when The DFIR Report revealed its use in Truebot operations. In these operations, following the successful download of a malicious file, Truebo
Dewmode	Unspecified	1	DEWMODE is a malicious web shell malware, written in PHP, designed to interact with MySQL databases and specifically target Accellion FTA devices. It operates by infiltrating the compromised network and exfiltrating data. During 2020-2021, threat actor group TA505 exploited several zero-day vulnerab
Snatch	Unspecified	1	Snatch is a type of malware, specifically ransomware, designed to infiltrate systems undetected, often through suspicious downloads, emails, or websites. Once inside the system, it can wreak havoc by stealing personal information, disrupting operations, or holding data hostage for ransom. The Snatch

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
cl0p	Unspecified	2	Cl0p is a threat actor group that has emerged as the most used ransomware in March 2023, dethroning LockBit. The group has successfully exploited zero-day vulnerabilities in the past, but such attacks are relatively rare. Recent research by Malwarebytes highlights the bias of ransomware gangs for at
TA505	Unspecified	1	TA505, also known as Cl0p Ransomware Gang and Lace Tempest, is a highly active and sophisticated cybercriminal group. The group has been associated with various high-profile cyber-attacks, demonstrating adaptability through a multi-vector approach to their operations. In June 2023, the U.S. Cybersec
Quant Loader	Unspecified	1	Quant Loader is a significant threat actor in the realm of cybersecurity, known for executing actions with malicious intent. It has been linked to various malware campaigns, distributing harmful software such as GandCrab ransomware, DreamSmasher, Dridex, and itself - Quant Loader. The threat actor o

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Source Document References

Information about the FlawedAmmyy Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
Fortinet	a year ago	Ransomware Roundup - Cl0p \| FortiGuard Labs
Flashpoint	a year ago	No title
CISA	a year ago	#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability \| CISA
CERT-EU	a year ago	#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability – Cyber Safe NV
MITRE	a year ago	TA505 shifts with the times \| Proofpoint US
MITRE	a year ago	TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader \| Proofpoint US
MITRE	a year ago	Ammyy Admin Malware - FlawedAmmy Download \| Proofpoint