Ammyy Admin

The AMMYY RAT, or FlawedAmmyy, is a Remote Access Trojan that gives criminals backdoor control over infected PCs. The actions of a remote attacker can result in the theft of confidential information, the installation of other threats, significant changes to the file system and other security issues. Since this Trojan runs without the user's knowledge, malware experts recommend using anti-malware programs capable of deleting the AMMYY RAT automatically before taking steps for re-securing the PC and its data.

Legal Software Twisted to Illegal Uses

The Ammyy Admin Remote Administration Tool is in conscription in a series of Black Hat campaigns that, unusually, are attacking both specific company networks, such as entities in the automotive industry, as well as random PC users. The earliest cases of these the AMMYY RAT attacks date back to 2016, with millions of spam e-mail messages being the evident infection vectors. Malware experts also are taking note of a possible connection to TA505, a criminal who's familiar with exploiting the Dridex banking Trojan and the file-locking Globe Imposter Ransomware.

The AMMYY RAT uses Trojan downloaders circulating through a combination of e-mail-attached ZIP archives with fake URL shortcut files, as well as Word documents with macro exploits. Most of the AMMYY RAT's source bases itself off of a leak of the Ammyy Admin product and, like that software, doesn't require installation and uses a small executable. Examples of some of the features malware analysts are noting as hazardous to infected PCs especially include:

• File-transferring capabilities can let criminals upload confidential files from an infected PC to their private servers, or download other ones to the PC (such as installers for other Trojans)
• Traditional remote desktop functionality offers external control via user input devices, such as the mouse and keyboard and remote-viewing sessions.
• The AMMYY RAT may bypass firewall protection and NATs that would ordinarily help secure a network by blocking suspicious traffic.

An AMMYY RAT infection, like any backdoor-capable threat, also implies the possible presence of banking Trojans, spyware, and other threatening software, due to how much control it grants the remote attacker over the computer.

Curtailing the Administration that's Coming from the Wrong Places

Most recently, the AMMYY RAT attacks also occurred in early March of this year. Since these attacks have, previously, gone undetected by the AV industry, users should be stringent about updating all appropriate security software for reducing the failure rates for detecting this threat. The AMMYY RAT can run on Windows 2000 up to Windows 8, including server, 32-bit, and 64-bit architecture. Both the general public and highly-financed corporate entities are in equal danger from the Remote Access Trojan's campaigning, whose threat actor is using high traffic bursts of spam e-mail attacks lasting one or two days at a time.

Social engineering exploits often help drop threats like the AMMYY RAT, and malware analysts are connecting two of them, in particular, with the latest infections. Fake invoice and billing information may trick a PC user into opening a Trojan downloader without knowing. Alternately, the installer embeds itself in a document macro, which the criminal disguises as being an encryption-based security feature. Any competent anti-malware solution should block both of these attacks or may remove the AMMYY RAT from your computer afterward.

Since the leveraging of the AMMYY RAT is so indiscriminate, its operational goal may be no more complicated than compromising the victims for money. However, it's just as possible that different criminals are exploiting the Ammyy Admin's toolset for various ends, with the overall consequences yet to be recorded.

Technical Details