Ammyy download carried Kasidet

The Ammyy pattern returned in June 2018. ESET observed the official site serving a poisoned Ammyy Admin download from shortly after midnight on June 13 until the morning of June 14. The legitimate remote-access tool remained present; the wrapper added the malware.

The installer was named AA_v3.exe, as before. Attackers used SmartInstaller to build a new binary that dropped Ammyy_Service.exe before installing Ammyy Admin. That file carried Win32/Kasidet, a multipurpose bot and banking malware sold in criminal markets.

Kasidet searched for files likely to contain passwords or cryptocurrency wallet material, including wallet.dat, pass.txt, and passwords.txt. It also reported running processes tied to wallets, password managers, remote desktop tools, and administration tools, including Electrum, Exodus, KeePass, PuTTY, WinSCP, Xshell, Radmin, and vSphere.

The command server was fifa2018start.info, a name chosen to blend into World Cup noise. The attack was short, but the lesson was familiar: a vendor download for a remote-administration tool gives criminals both reach and plausible cover.

Motive

Financial Gain Data Theft

Attribution

Group

Cause

Website Compromise

Transitive

No

Actor

Unknown cybercriminal actors

• Ammyy Admin compromised with malware again; World Cup used as coverwelivesecurity.com
• Ammyy Admin - cases of malicious use. Official WARNING.ammyy.com