Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 14:54:48 UTC Home > List all groups > List all tools > List all groups using tool Andaratm Tool: Andaratm Names Andaratm Category Malware Type Backdoor, Exfiltration Description (AhnLab) Andaratm malware was used in attacks on military agencies in 2016, on ATMs and financial institutions in 201 on cryptocurrencyexchanges in 2018. 18 variants have been identified as of May 2018.The codesof Andaratm include stri such as '%s\cmd.exe /c echo | %s > %s'and '%s*****%s.' When Andaratm is executed, it acquires information, such as the computer name and username, attempts to connect to th designated C2 server, and receives and executes the command. The encryption method of Andaratm is similar to the methods generally used by malware. Andaratm only executes simple commands, such as downloading files, uploading files, and running cmd.exe files. Information