Procedure examples

FlawedAmmyy may obfuscate portions of the initial C2 handshake.

FlawedAmmyy has collected information and files from a compromised machine.

FlawedAmmyy enumerates the current user during the initial infection.

FlawedAmmyy has sent data collected from a compromised host to its C2 servers.

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.

FlawedAmmyy can collect mouse events.

FlawedAmmyy can collect keyboard events.

FlawedAmmyy has used PowerShell to execute commands.

FlawedAmmyy has used `cmd` to execute commands on a compromised host.

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.

FlawedAmmyy can execute batch scripts to delete files.

FlawedAmmyy has used HTTP for C2.

FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.

FlawedAmmyy can transfer files from C2.

FlawedAmmyy can capture screenshots.

FlawedAmmyy can collect clipboard data.

FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.

FlawedAmmyy has been installed via `msiexec.exe`.

FlawedAmmyy has used `rundll32` for execution.

FlawedAmmyy will attempt to detect anti-virus products during the initial infection.

FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.