{ "id": "17b6643d-8424-41ac-a2d3-8fb61c314e24", "created_at": "2026-04-06T00:08:32.14627Z", "updated_at": "2026-04-10T03:38:18.966382Z", "deleted_at": null, "sha1_hash": "ea5a684714a4ceb002ddd1c24041c17dd4cd7c20", "title": "MAR-10135536-21 – North Korean Proxy Malware: ELECTRICFISH | CISA", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 67379, "plain_text": "MAR-10135536-21 – North Korean Proxy Malware: ELECTRICFISH |\r\nCISA\r\nPublished: 2019-09-09 · Archived: 2026-04-05 21:15:22 UTC\r\nNotification\r\nThis report is provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not\r\nprovide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial\r\nproduct or service referenced in this bulletin or otherwise.\r\nThis document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries\r\nminimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to\r\nstandard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the\r\nTraffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.\r\nSummary\r\nDescription\r\nThis Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS),\r\nthe Federal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners,\r\nDHS, FBI, and DoD identified proxy malware variants used by the North Korean government - referred to by the U.S.\r\nGovernment as ELECTRICFISH. The U.S. Government refers to malicious cyber activity by the North Korean government\r\nas HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.\r\nDHS, FBI, and DoD are distributing this MAR to enable network defense and reduce exposure to North Korean government\r\nmalicious cyber activity.\r\nThis MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended\r\nmitigation techniques. Users or administrators should flag activity associated with the malware, report the activity to the\r\nDHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and\r\ngive the activity the highest priority for enhanced mitigation.\r\nThis report provides analysis of two malicious 32-bit Windows executable file. The malware implements a custom protocol\r\nthat allows traffic to be tunneled between a source and a destination Internet Protocol (IP) address. The malware\r\ncontinuously attempts to reach out to the source and the designation system, which allows either side to initiate a tunneling\r\nsession. The malware can be configured with a proxy server/port and proxy username and password. This feature allows\r\nconnectivity to a system sitting inside of a proxy server, which allows the actor to bypass the compromised system’s\r\nrequired authentication to reach outside of the network.\r\nFor a downloadable copy of IOCs, see:\r\nMAR-10135536-21.stix\r\nSubmitted Files (2)\r\n7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1 (0BA6BB2AD05D86207B5303657E3F68...)\r\na1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb (8d9123cd2648020292b5c35edc9ae2...)\r\nFindings\r\na1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb\r\nTags\r\ndroppertrojan\r\nDetails\r\nName 8d9123cd2648020292b5c35edc9ae22e\r\nSize 1422336 bytes\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nPage 1 of 6\n\nType PE32 executable (GUI) Intel 80386, for MS Windows\r\nMD5 8d9123cd2648020292b5c35edc9ae22e\r\nSHA1 0939363ff55d914e92635e5f693099fb28047602\r\nSHA256 a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb\r\nSHA512 646697e3d5146e05a221183f6c9f00f5eb38400ef9a2f83bfd0fcf2f8af1a7efff99c0a3486740c745ce6cf0939c4f0678cb818cbbff8ed2b28a7\r\nssdeep 24576:HsO8RKL6OLnWZGFbHq0aMow5Q3gkD/74tU3hYPgP5IyrMsEOhVRpxHkADUHEPbzJ:0KjKHMbO3pkoBIyIstVRpxHL1b\r\nEntropy 6.703195\r\nAntivirus\r\nAhnlab HackTool/Win32.Agent\r\nAntiy Trojan[Banker]/Win32.Alreay\r\nAvira TR/AD.Stantinko.gkqij\r\nBitDefender Gen:Variant.Ursu.349885Unclassified\r\nClamAV Win.Dropper.Electricfish-6976665-0\r\nCyren W32/Trojan.TWUO-7654\r\nESET a variant of Win32/NukeSped.FQ trojan\r\nEmsisoft Gen:Variant.Ursu.349885 (B)\r\nIkarus Trojan.Win32.HackTool\r\nK7 Hacktool ( 0054e46d1 )\r\nKaspersky Trojan.Win32.Agent.xaadtn\r\nMcAfee ElectricFish\r\nMicrosoft Security Essentials HackTool:Win32/ElecFish.A!dha\r\nNANOAV Trojan.Win32.Alreay.fvrmai\r\nQuick Heal Trojan.Ursu\r\nSophos Troj/ElecFish-A\r\nSymantec Unavailable (production)\r\nTACHYON Trojan/W32.Electricfish.1422336\r\nVirusBlokAda Trojan.Agent\r\nZillya! Tool.ElectricFish.Win32.2\r\nYara Rules\r\nhidden_cobra_consolidated.yara\r\nrule electricfish { meta: Author = \"CISA trusted 3rd party\" Incident = \"10135536\"\r\nDate = \"2019-08-14\" Category = \"Hidden_Cobra\" Family = \"ELECTRICFISH\"\r\nDescription = \"Detects logging functionality\" MD5_1 =\r\n\"0ba6bb2ad05d86207b5303657e3f6874\" SHA256_1 =\r\n\"7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1\"\r\nstrings: $ = \"LLgcIP\" $ = \"CCGC_LOG\" $ = \"LLGC_LOG\" condition: uint16(0)\r\n== 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them }\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nPage 2 of 6\n\nCompile Date 2018-09-29 11:55:36-04:00\r\nImport Hash 3549cfa19e60aa9239f79d80e19279fa\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n08bb17d8e839e7fc92426e813a696e73 header 1024 2.590786\r\n6c3daca3c522ab98a8ac12a45087297c .text 983040 6.595856\r\n3d3d7962d16652002018640a3fa27d44 .rdata 340480 6.187858\r\nb7f382ea7e6c9c8e737cb92551341e64 .data 37888 4.714377\r\n871fb8486e5ea3307ff7b65ddf46518a .rsrc 512 5.112624\r\n382715f8e776a544bf70f843a52e3ff2 .reloc 59392 6.015022\r\nPackers/Compilers/Cryptors\r\nMicrosoft Visual C++ ?.?\r\nDescription\r\nThis file is a malicious Windows 32-bit executable. The application is a command-line utility and its primary purpose is to\r\ntunnel traffic between two IP addresses. The application accepts the following command-line arguments, which can be\r\nutilized to authenticate with a proxy server:\r\n--Begin command-line arguments--\r\n-l,--log [Show Debug Message]\r\n-pw,--password [Password]\r\n-u,--username [UserName]\r\n-do,--domain [DomainName]\r\n-p,--proxy [ProxyIP:Port]\r\n-d,--destination [TargetIP:Port]\r\n-s,--server [LLgcIP:Port]\r\n-h,--help [Show this help message]\r\n--End command-line arguments--\r\nDisplayed below is an example:\r\n--Begin Example Usage--\r\nSource IP/Port: 192.0.2.1:92\r\nDest IP/Port: 198.51.100.1:92\r\nProxy IP/Port: 203.0.113.1:92\r\nProxy User Name: test\r\nProxy Password: testpw\r\na12.exe -s 192.0.2.1:92 -d 198.51.100.1:92 -p 203.0.113.1:92 -u test -pw testpw\r\n--End Example Usage--\r\nIt will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to\r\nboth the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to\r\nrapidly and efficiently be tunneled between two machines. If necessary, the malware can authenticate with a proxy to be able\r\nto reach the destination IP address. A configured proxy server is not required for this utility.\r\nAfter the malware authenticates with the configured proxy, it will immediately attempt to establish a session with the\r\ndestination IP address, located outside of the target network and the source IP address. The header of the initial\r\nauthentication packet, sent to both the source and destination systems, will be static except for two random bytes.\r\nEverything within this 34-byte header is static except for the bytes 0X2B6E, which will change during each connection\r\nattempt. Displayed below (and displayed in Figure 7) is the packet header.\r\n--Begin Authentication Packet Sent to Destination System--\r\n6161616162626262636363636464646400000000000000002B6E0000040000009210\r\n--End Authentication Packet Sent to Destination System--\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nPage 3 of 6\n\nScreenshots\r\nFigure 1 -\r\nFigure 2 -\r\nFigure 3 -\r\nFigure 4 -\r\nFigure 5 -\r\nFigure 6 -\r\nFigure 7 -\r\n7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1\r\nTags\r\ntrojan\r\nDetails\r\nName 0BA6BB2AD05D86207B5303657E3F6874\r\nSize 1436160 bytes\r\nType PE32 executable (GUI) Intel 80386, for MS Windows\r\nMD5 0ba6bb2ad05d86207b5303657e3f6874\r\nSHA1 ad44567c8709df4889d381a0a64cc4b49e5004c3\r\nSHA256 7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1\r\nSHA512 cce39d397a661a5b1c7504f4001e1683231b4d8fb77499102c06532b3ec38f775e544493166e75076460f444b27a15a1ab68237ceb26454b\r\nssdeep 24576:NUPhrrn8YtZM9hjGMjxyK9Ws/6oYJt1wY2ZJIZ7IOAZSRpxtwQDCbzEG:qKjGMjQcGsw7IFSRpxtnDCbF\r\nEntropy 6.704631\r\nAntivirus\r\nAegisLab Trojan.Win32.Alreay.tqBn\r\nAhnlab HackTool/Win32.Agent\r\nAntiy Trojan[Banker]/Win32.Alreay\r\nAvira TR/AD.Stantinko.ysgqb\r\nBitDefender Trojan.GenericKD.32262757Unclassified\r\nCyren W32/Alreay.DVWS-3035\r\nESET a variant of Win32/NukeSped.FQ trojan\r\nEmsisoft Trojan.GenericKD.32262757 (B)\r\nIkarus Trojan.Win32.HackTool\r\nK7 Trojan ( 00555fff1 )\r\nKaspersky Trojan-Banker.Win32.Alreay.gen\r\nNANOAV Trojan.Win32.Alreay.fvvzst\r\nQuick Heal Trojan.Alreay\r\nSophos Troj/ElecFish-A\r\nSymantec Unavailable (production)\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nPage 4 of 6\n\nVirusBlokAda TrojanBanker.Alreay\r\nYara Rules\r\nhidden_cobra_consolidated.yara\r\nrule electricfish { meta: Author = \"CISA trusted 3rd party\" Incident = \"10135536\"\r\nDate = \"2019-08-14\" Category = \"Hidden_Cobra\" Family = \"ELECTRICFISH\"\r\nDescription = \"Detects logging functionality\" MD5_1 =\r\n\"0ba6bb2ad05d86207b5303657e3f6874\" SHA256_1 =\r\n\"7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1\"\r\nstrings: $ = \"LLgcIP\" $ = \"CCGC_LOG\" $ = \"LLGC_LOG\" condition: uint16(0)\r\n== 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them }\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2018-11-14 20:15:34-05:00\r\nImport Hash 6627b5310efbf9651800ff9ae616be5f\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\na781fcd65f93beca71b7b94c3a82ba84 header 1024 2.613318\r\nb081ec452c4927cbc91e8d5d36e75eeb .text 996352 6.592977\r\n131c905ab5153076e77c057bedabcb0d .rdata 340992 6.196190\r\n7261cf1375f63e279189afc08b5486f4 .data 37888 4.740711\r\nbef352ccee242ff585187966059808aa .rsrc 512 5.112624\r\n39f472191c636cf6112a68713b5e6114 .reloc 59392 6.065172\r\nPackers/Compilers/Cryptors\r\nMicrosoft Visual C++ ?.?\r\nDescription\r\nThis file is a malicious Windows 32-bit executable. The application is a command-line utility and its primary purpose is to\r\ntunnel traffic between two IP addresses. This file is a variant of 8d9123cd2648020292b5c35edc9ae22e.\r\nDisplayed below is the session header of the initial authentication packet, sent to both the source and destination systems:\r\n--Begin TCP session header--\r\nCONNECT Server IP:PORT HTTP/1.0\r\nUser-Agent:Mozilla/4.0 (compatible; MSIE 5.5; Win32)\r\nproxy-Connection: Keep-Alive\r\nPragma: no-cache\r\nProxy-Authorization: NTLM\r\nTlRMTVNTUAABAAAAB4IIAAwADAAoAAAADwAPADQAAAAAAAAAAAAAAFdXVy5HT1RPLkNPTVdJTi00OUFUTlVSNjZNVA==\r\n--End TCP session header--\r\nRecommendations\r\nCISA recommends that users and administrators consider using the following best practices to strengthen the security\r\nposture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators\r\nprior to implementation to avoid unwanted impacts.\r\nMaintain up-to-date antivirus signatures and engines.\r\nKeep operating system patches up-to-date.\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nPage 5 of 6\n\nDisable File and Printer sharing services. If these services are required, use strong passwords or Active Directory\r\nauthentication.\r\nRestrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local\r\nadministrators group unless required.\r\nEnforce a strong password policy and implement regular password changes.\r\nExercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be\r\nknown.\r\nEnable a personal firewall on agency workstations, configured to deny unsolicited connection requests.\r\nDisable unnecessary services on agency workstations and servers.\r\nScan for and remove suspicious e-mail attachments; ensure the scanned attachment is its \"true file type\" (i.e., the\r\nextension matches the file header).\r\nMonitor users' web browsing habits; restrict access to sites with unfavorable content.\r\nExercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).\r\nScan all software downloaded from the Internet prior to executing.\r\nMaintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).\r\nAdditional information on malware incident prevention and handling can be found in National Institute of Standards and\r\nTechnology (NIST) Special Publication 800-83, \"Guide to Malware Incident Prevention \u0026 Handling for Desktops and\r\nLaptops\".\r\nContact Information\r\nDocument FAQ\r\nWhat is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in\r\na timely manner. In most instances this report will provide initial indicators for computer and network defense. To request\r\nadditional analysis, please contact CISA and provide information regarding the level of desired analysis.\r\nWhat is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware\r\nanalysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide\r\ninformation regarding the level of desired analysis.\r\nCan I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to\r\nthis document should be directed to the CISA at 1-888-282-0870 or contact@mail.cisa.dhs.gov .\r\nCan I submit malware to CISA? Malware samples can be submitted via three methods:\r\nWeb: https://malware.us-cert.gov\r\nE-Mail: submit@malware.us-cert.gov\r\nFTP: ftp.malware.us-cert.gov (anonymous)\r\nCISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software\r\nvulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.us-cert.gov.\r\nSource: https://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar19-252b\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.us-cert.gov/ncas/analysis-reports/ar19-252b" ], "report_names": [ "ar19-252b" ], "threat_actors": [ { "id": "34eea331-d052-4096-ae03-a22f1d090bd4", "created_at": "2025-08-07T02:03:25.073494Z", "updated_at": "2026-04-10T02:00:03.709243Z", "deleted_at": null, "main_name": "NICKEL ACADEMY", "aliases": [ "ATK3 ", "Black Artemis ", "COVELLITE ", "CTG-2460 ", "Citrine Sleet ", "Diamond Sleet ", "Guardians of Peace", "HIDDEN COBRA ", "High Anonymous", "Labyrinth Chollima ", "Lazarus Group ", "NNPT Group", "New Romanic Cyber Army Team", "Temp.Hermit ", "UNC577 ", "Who Am I?", "Whois Team", "ZINC " ], "source_name": "Secureworks:NICKEL ACADEMY", "tools": [ "Destover", "KorHigh", "Volgmer" ], "source_id": "Secureworks", "reports": null }, { "id": "732597b1-40a8-474c-88cc-eb8a421c29f1", "created_at": "2025-08-07T02:03:25.087732Z", "updated_at": "2026-04-10T02:00:03.776007Z", "deleted_at": null, "main_name": "NICKEL GLADSTONE", "aliases": [ "APT38 ", "ATK 117 ", "Alluring Pisces ", "Black Alicanto ", "Bluenoroff ", "CTG-6459 ", "Citrine Sleet ", "HIDDEN COBRA ", "Lazarus Group", "Sapphire Sleet ", "Selective Pisces ", "Stardust Chollima ", "T-APT-15 ", "TA444 ", "TAG-71 " ], "source_name": "Secureworks:NICKEL GLADSTONE", "tools": [ "AlphaNC", "Bankshot", "CCGC_Proxy", "Ratankba", "RustBucket", "SUGARLOADER", "SwiftLoader", "Wcry" ], "source_id": "Secureworks", "reports": null }, { "id": "a2b92056-9378-4749-926b-7e10c4500dac", "created_at": "2023-01-06T13:46:38.430595Z", "updated_at": "2026-04-10T02:00:02.971571Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Operation DarkSeoul", "Bureau 121", "Group 77", "APT38", "NICKEL GLADSTONE", "G0082", "COPERNICIUM", "Moonstone Sleet", "Operation GhostSecret", "APT 38", "Appleworm", "Unit 121", "ATK3", "G0032", "ATK117", "NewRomanic Cyber Army Team", "Nickel Academy", "Sapphire Sleet", "Lazarus group", "Hastati Group", "Subgroup: Bluenoroff", "Operation Troy", "Black Artemis", "Dark Seoul", "Andariel", "Labyrinth Chollima", "Operation AppleJeus", "COVELLITE", "Citrine Sleet", "DEV-0139", "DEV-1222", "Hidden Cobra", "Bluenoroff", "Stardust Chollima", "Whois Hacking Team", "Diamond Sleet", "TA404", "BeagleBoyz", "APT-C-26" ], "source_name": "MISPGALAXY:Lazarus Group", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "32a223a8-3c79-4146-87c5-8557d38662ae", "created_at": "2022-10-25T15:50:23.703698Z", "updated_at": "2026-04-10T02:00:05.261989Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Lazarus Group", "Labyrinth Chollima", "HIDDEN COBRA", "Guardians of Peace", "NICKEL ACADEMY", "Diamond Sleet" ], "source_name": "MITRE:Lazarus Group", "tools": [ "RawDisk", "Proxysvc", "BADCALL", "FALLCHILL", "WannaCry", "MagicRAT", "HOPLIGHT", "TYPEFRAME", "Dtrack", "HotCroissant", "HARDRAIN", "Dacls", "KEYMARBLE", "TAINTEDSCRIBE", "AuditCred", "netsh", "ECCENTRICBANDWAGON", "AppleJeus", "BLINDINGCAN", "ThreatNeedle", "Volgmer", "Cryptoistic", "RATANKBA", "Bankshot" ], "source_id": "MITRE", "reports": null }, { "id": "f32df445-9fb4-4234-99e0-3561f6498e4e", "created_at": "2022-10-25T16:07:23.756373Z", "updated_at": "2026-04-10T02:00:04.739611Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "APT-C-26", "ATK 3", "Appleworm", "Citrine Sleet", "DEV-0139", "Diamond Sleet", "G0032", "Gleaming Pisces", "Gods Apostles", "Gods Disciples", "Group 77", "Guardians of Peace", "Hastati Group", "Hidden Cobra", "ITG03", "Jade Sleet", "Labyrinth Chollima", "Lazarus Group", "NewRomanic Cyber Army Team", "Operation 99", "Operation AppleJeus", "Operation AppleJeus sequel", "Operation Blockbuster: Breach of Sony Pictures Entertainment", "Operation CryptoCore", "Operation Dream Job", "Operation Dream Magic", "Operation Flame", "Operation GhostSecret", "Operation In(ter)caption", "Operation LolZarus", "Operation Marstech Mayhem", "Operation No Pineapple!", "Operation North Star", "Operation Phantom Circuit", "Operation Sharpshooter", "Operation SyncHole", "Operation Ten Days of Rain / DarkSeoul", "Operation Troy", "SectorA01", "Slow Pisces", "TA404", "TraderTraitor", "UNC2970", "UNC4034", "UNC4736", "UNC4899", "UNC577", "Whois Hacking Team" ], "source_name": "ETDA:Lazarus Group", "tools": [ "3CX Backdoor", "3Rat Client", "3proxy", "AIRDRY", "ARTFULPIE", "ATMDtrack", "AlphaNC", "Alreay", "Andaratm", "AngryRebel", "AppleJeus", "Aryan", "AuditCred", "BADCALL", "BISTROMATH", "BLINDINGCAN", "BTC Changer", "BUFFETLINE", "BanSwift", "Bankshot", "Bitrep", "Bitsran", "BlindToad", "Bookcode", "BootWreck", "BottomLoader", "Brambul", "BravoNC", "Breut", "COLDCAT", "COPPERHEDGE", "CROWDEDFLOUNDER", "Castov", "CheeseTray", "CleanToad", "ClientTraficForwarder", "CollectionRAT", "Concealment Troy", "Contopee", "CookieTime", "Cyruslish", "DAVESHELL", "DBLL Dropper", "DLRAT", "DRATzarus", "DRATzarus RAT", "Dacls", "Dacls RAT", "DarkComet", "DarkKomet", "DeltaCharlie", "DeltaNC", "Dembr", "Destover", "DoublePulsar", "Dozer", "Dtrack", "Duuzer", "DyePack", "ECCENTRICBANDWAGON", "ELECTRICFISH", "Escad", "EternalBlue", "FALLCHILL", "FYNLOS", "FallChill RAT", "Farfli", "Fimlis", "FoggyBrass", "FudModule", "Fynloski", "Gh0st RAT", "Ghost RAT", "Gopuram", "HARDRAIN", "HIDDEN COBRA RAT/Worm", "HLOADER", "HOOKSHOT", "HOPLIGHT", "HOTCROISSANT", "HOTWAX", "HTTP Troy", "Hawup", "Hawup RAT", "Hermes", "HotCroissant", "HotelAlfa", "Hotwax", "HtDnDownLoader", "Http Dr0pper", "ICONICSTEALER", "Joanap", "Jokra", "KANDYKORN", "KEYMARBLE", "Kaos", "KillDisk", "KillMBR", "Koredos", "Krademok", "LIGHTSHIFT", "LIGHTSHOW", "LOLBAS", "LOLBins", "Lazarus", "LightlessCan", "Living off the Land", "MATA", "MBRkiller", "MagicRAT", "Manuscrypt", "Mimail", "Mimikatz", "Moudour", "Mydoom", "Mydoor", "Mytob", "NACHOCHEESE", "NachoCheese", "NestEgg", "NickelLoader", "NineRAT", "Novarg", "NukeSped", "OpBlockBuster", "PCRat", "PEBBLEDASH", "PLANKWALK", "POOLRAT", "PSLogger", "PhanDoor", "Plink", "PondRAT", "PowerBrace", "PowerRatankba", "PowerShell RAT", "PowerSpritz", "PowerTask", "Preft", "ProcDump", "Proxysvc", "PuTTY Link", "QUICKRIDE", "QUICKRIDE.POWER", "Quickcafe", "QuiteRAT", "R-C1", "ROptimizer", "Ratabanka", "RatabankaPOS", "Ratankba", "RatankbaPOS", "RawDisk", "RedShawl", "Rifdoor", "Rising Sun", "Romeo-CoreOne", "RomeoAlfa", "RomeoBravo", "RomeoCharlie", "RomeoCore", "RomeoDelta", "RomeoEcho", "RomeoFoxtrot", "RomeoGolf", "RomeoHotel", "RomeoMike", "RomeoNovember", "RomeoWhiskey", "Romeos", "RustBucket", "SHADYCAT", "SHARPKNOT", "SIGFLIP", "SIMPLESEA", "SLICKSHOES", "SORRYBRUTE", "SUDDENICON", "SUGARLOADER", "SheepRAT", "SierraAlfa", "SierraBravo", "SierraCharlie", "SierraJuliett-MikeOne", "SierraJuliett-MikeTwo", "SimpleTea", "SimplexTea", "SmallTiger", "Stunnel", "TAINTEDSCRIBE", "TAXHAUL", "TFlower", "TOUCHKEY", "TOUCHMOVE", "TOUCHSHIFT", "TOUCHSHOT", "TWOPENCE", "TYPEFRAME", "Tdrop", "Tdrop2", "ThreatNeedle", "Tiger RAT", "TigerRAT", "Trojan Manuscript", "Troy", "TroyRAT", "VEILEDSIGNAL", "VHD", "VHD Ransomware", "VIVACIOUSGIFT", "VSingle", "ValeforBeta", "Volgmer", "Vyveva", "W1_RAT", "Wana Decrypt0r", "WanaCry", "WanaCrypt", "WanaCrypt0r", "WannaCry", "WannaCrypt", "WannaCryptor", "WbBot", "Wcry", "Win32/KillDisk.NBB", "Win32/KillDisk.NBC", "Win32/KillDisk.NBD", "Win32/KillDisk.NBH", "Win32/KillDisk.NBI", "WinorDLL64", "Winsec", "WolfRAT", "Wormhole", "YamaBot", "Yort", "ZetaNile", "concealment_troy", "http_troy", "httpdr0pper", "httpdropper", "klovbot", "sRDI" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434112, "ts_updated_at": 1775792298, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/ea5a684714a4ceb002ddd1c24041c17dd4cd7c20.pdf", "text": "https://archive.orkl.eu/ea5a684714a4ceb002ddd1c24041c17dd4cd7c20.txt", "img": "https://archive.orkl.eu/ea5a684714a4ceb002ddd1c24041c17dd4cd7c20.jpg" } }