{
	"id": "820af010-a654-4434-b247-d23260876ef9",
	"created_at": "2026-04-06T00:14:19.368392Z",
	"updated_at": "2026-04-10T13:12:39.513339Z",
	"deleted_at": null,
	"sha1_hash": "7f93b0dd64e305947af44e989fc3bd59a08bc66f",
	"title": "Elirks (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 28492,
	"plain_text": "Elirks (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 21:32:27 UTC\r\nElirks is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from\r\ncompromised systems. Mostly attacks using Elirks occurring in East Asia. One of the unique features of the\r\nmalware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers\r\ncreate accounts on those services and post encoded IP addresses or the domain names of real C2 servers in\r\nadvance of distributing the backdoor. Multiple Elirks variants using Japanese blog services for the last couple of\r\nyears.\r\n[TLP:WHITE] win_elirks_auto (20251219 | Detects win.elirks.)\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.elirks\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks"
	],
	"report_names": [
		"win.elirks"
	],
	"threat_actors": [],
	"ts_created_at": 1775434459,
	"ts_updated_at": 1775826759,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7f93b0dd64e305947af44e989fc3bd59a08bc66f.pdf",
		"text": "https://archive.orkl.eu/7f93b0dd64e305947af44e989fc3bd59a08bc66f.txt",
		"img": "https://archive.orkl.eu/7f93b0dd64e305947af44e989fc3bd59a08bc66f.jpg"
	}
}