Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe

Hunt Hypothesis

This hunt detects the execution of specific remote administration tools (AA_v3.4.exe and AA_v3.5.exe) associated with the APT group Anunak, which adversaries often leverage to establish persistent access and conduct lateral movement within compromised networks. The SOC team should proactively search for these artifacts in Azure Sentinel because their presence may indicate an early-stage intrusion by a sophisticated threat actor utilizing known Russian remote management utilities to evade standard detection mechanisms.

YARA Rule

rule Ammyy_Admin_AA_v3 {
	meta:
		description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
		author = "Florian Roth"
		reference = "http://goo.gl/gkAg2E"
		date = "2014/12/22"
		score = 55
		hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
		hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
	strings:
		$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
		$x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
		$x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
		$x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
		$x5 = "Please enter password for accessing remote computer" fullword ascii

		$s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
		$s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
		$s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
	condition:
		2 of ($x*) or all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• http://goo.gl/gkAg2E
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Remote Admin Tool used by APT group Anunak detection rule, including suggested filters and exclusions:

• Scenario: Internal IT Department using a legacy RMM (Remote Monitoring and Management) agent that coincidentally shares the filename AA_v3.4.exe or AA_v3.5.exe.

  • Context: Many enterprises utilize custom-wrapped agents for patch management or asset discovery where the executable name matches the APT indicator exactly, often deployed via SCCM or Intune to all workstations.
  • Suggested Filter/Exclusion: Create a whitelist based on the Source IP Address (e.g., 10.x.x.x range for internal management servers) and verify that the file hash matches the known good hash of the internal RMM agent rather than the APT’s specific hash.

• Scenario: Scheduled maintenance jobs running automated remote administration scripts during off-hours.

  • Context: The organization runs nightly batch jobs (e.g., via Windows Task Scheduler or Ansible Tower) that deploy a utility named AA_v3.5.exe to perform remote registry updates or software inventory scans across the domain.
  • Suggested Filter/Exclusion: Exclude alerts where the Process Parent is a known scheduler service (e.g., svchost.exe with specific service name, or TaskScheduler.exe) and the execution time falls within the defined maintenance window (e.g., 02:00 – 04:00 local time).

• Scenario: Third-party vendor support sessions utilizing a remote access tool with identical naming conventions.

  • Context: External vendors (such as database administrators or cloud consultants) connect to production servers using a proprietary remote tool named AA_v3.4.exe that is pre-installed on the jump hosts they