<b>MAV-2024-001</b>: FlawedAmmy RAT - Remote Access Trojan with Flawed Encryption and Persistence (PE32)

FlawedAmmyy is a remote access Trojan (RAT) – a malware that is utilized by attackers to take full control over the target machine. Which is based on leaked Ammyy Admin software. Ammyy Admin is a popular remote access tool used by businesses and consumers to handle remote control and diagnostics on Microsoft Windows machines which makes the FlawedAmmyy RAT to exhibit the functionality of the leaked version, including Gain complete access to PCs’ camera and microphone, Capture screenshots, Access a variety of services, steal files and credentials, Steal customer data, proprietary information and more. FlawedAmmyy was used in both massive campaigns such as phishing campaigns, to potentially create a large base of compromised computers, as well as targeted campaigns that create opportunities for actors to steal customer data, proprietary information, and more. In the latest campaign of TA505 which is a prolific Cybercriminal group known for attacks against multiple financial institutions and retail companies, they started using HTML attachments to deliver malicious .XLS files that lead to downloader and backdoor FlawedAmmyy, mostly to target South Korean users.