/
← Voltar ao feed
low

Cisco EVE detects Flawed AMMYY RAT download attempts on Splunk .conf conference network

1 fonte(s) · 1 atualização(ões) · publicado 08/10/2026 12:00 · coletado há 4 dias

During the Splunk .conf conference, Cisco's Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) produced a previously unseen detection of Flawed AMMYY, a RAT built from leaked AMMYY source code, alongside the usual detections of Upatre, Xpiro and Quasar. Detections arrived in HTTP/HTTPS pairs with identical timestamps from a single internal endpoint. EVE used session fingerprinting to distinguish Flawed AMMYY from the legitimate-but-abused AMMYY remote access tool. The article is a product-oriented case study; it does not confirm whether the file was downloaded or installed.

Detalhes técnicos

  • EVE assigned a confidence score of 82 to the HTTPS connection and 99 to the HTTP connection, because the HTTP session exposed full details, including an attempted .exe download.
  • The HTTPS detection was mapped to MITRE Command and Control | Encrypted Channel.
  • Endace full packet capture showed the endpoint (10.x.x.x) issuing a GET for an .exe to a server (136.x) that answered with a 301 Moved Permanently redirect and closed with FIN, implying the client then retried over HTTPS.
  • Whether the HTTPS download succeeded and the file was installed was not determined and requires endpoint analysis.

Remediação

  • Perform endpoint analysis to identify the process behind the repeated download attempts, and verify whether the .exe was retrieved over HTTPS and installed.
  • Where feasible, use TLS decryption to gain full session visibility on HTTPS traffic.

Linha do tempo

  1. blogs.cisco.com ↗ · pub. 08/10/2026 12:00 · coletado 19/10 18:08 primeiro registro

    Cisco EVE detects Flawed AMMYY RAT download attempts on Splunk .conf conference network

    ler a análise desta fonte

    During the Splunk .conf conference, Cisco's Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) produced a previously unseen detection of Flawed AMMYY, a RAT built from leaked AMMYY source code, alongside the usual detections of Upatre, Xpiro and Quasar. Detections arrived in HTTP/HTTPS pairs with identical timestamps from a single internal endpoint. EVE used session fingerprinting to distinguish Flawed AMMYY from the legitimate-but-abused AMMYY remote access tool. The article is a product-oriented case study; it does not confirm whether the file was downloaded or installed.

    Technical Details

    • EVE assigned a confidence score of 82 to the HTTPS connection and 99 to the HTTP connection, because the HTTP session exposed full details, including an attempted .exe download.
    • The HTTPS detection was mapped to MITRE Command and Control | Encrypted Channel.
    • Endace full packet capture showed the endpoint (10.x.x.x) issuing a GET for an .exe to a server (136.x) that answered with a 301 Moved Permanently redirect and closed with FIN, implying the client then retried over HTTPS.
    • Whether the HTTPS download succeeded and the file was installed was not determined and requires endpoint analysis.

    Remediation

    • Perform endpoint analysis to identify the process behind the repeated download attempts, and verify whether the .exe was retrieved over HTTPS and installed.
    • Where feasible, use TLS decryption to gain full session visibility on HTTPS traffic.