Loading malware…
AllaKore RAT is a publicly available Delphi-based remote access trojan that has been repeatedly used and modified by South Asian threat actors, most notably SideCopy, and has also been associated with Confucius. In SideCopy operations, modified AllaKore RAT variants have been deployed in espionage campaigns targeting Indian government, military, and defense-related entities, often using Ministry of Defence and other defense-themed lures. Observed delivery chains commonly begin with spearphishing archives containing malicious shortcut files that invoke MSHTA and staged HTA or DLL components, sometimes using DLL sideloading to launch the final RAT payload and establish persistence on compromised Windows systems.
Documented capabilities of AllaKore RAT include remote control of infected hosts, collection of system information, file and folder enumeration, file upload and download, execution of additional files, keylogging, screenshot capture, and theft of clipboard data. In SideCopy intrusions, the malware has also been integrated into multi-stage, environment-aware workflows that check installed antivirus products and alter execution paths accordingly. Campaign reporting indicates the malware has been deployed at scale against victims in India and has formed a recurring part of SideCopy's malware arsenal alongside other custom and commodity RATs.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The released simsre.exe is a AllaKore RAT (also known as Cyrus) commonly used by SideCopy. Its source code is open source on GitHub and has been modified by the SideCopy group as part of its own arsenal.
Arctic Wolf has spotted a financially motivated group named Greedy Sponge target organizations in Mexico with malspam that delivers versions of AllaKore RAT and SystemBC.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
As discussed in the analysis by QiAnXin, spear phishing was used as the initial delivery method for this campaign.
It uses a malicious LNK file as the entry point... Spear-phishing emails, with LNK files in compressed packages as the attack entry point
Opening the LNK triggers the MSHTA process, which executes a remote HTA file hosted on a compromised domain.
The downloaded HTA files are similar to Phase One. They load DLL in memory and first collect information of installed antivirus software in the system using WMI.
During the execution, a bat file is generated, which adds a startup item for the crezly.exe program through the registry.
to download a piece of JS code to execute. Its main function is to load DLL in memory, decrypt the embedded data in the JS code through the functions in the DLL
Opening the LNK triggers the MSHTA process, which executes a remote HTA file hosted on a compromised domain.
After decompression, it contains a hidden folder “Adobe” and a bait LNK file. The LNK file name is "Grant of Risk and Hardship Allowance."
a bat file is generated, which adds a startup item for the crezly.exe program through the registry... the program added to the startup item through the registry is also simsre.exe.
a bat file is generated, which adds a startup item for the crezly.exe program through the registry... the program added to the startup item through the registry is also simsre.exe.
The stage-1 HTA contains two embedded files... that are base64 encoded... Both the HTA contain embedded files...
The DLL files dropped are not sideloaded by the AllaKore RAT, and they are legitimate files... These are Microsoft Windows-related libraries...
Spear-phishing starts with an archive file containing a shortcut (LNK) in a double-extension format.
The stage-1 HTA contains two embedded files, a decoy and a DLL, that are base64 encoded.
Accessing the link in the LNK file will redirect to ... snbtoolswires.hta to download a piece of JS code to execute. | Analyzing the LNK file, it accesses the C2 using mshta.exe in the system to download and execute subsequent payloads.
Loading and executing subsequent payloads in memory without files... They load DLL in memory
Its main functions include: Keylogger
Persistence on the final payload is set beforehand via the Run registry key.
A connection ID based on the system information is created for each instance... getinfo Send username, machine name and OS information
Then, it obtains the information of installed antivirus software... The downloaded HTA files... first collect information of installed antivirus software in the system using WMI.
The functionality of AllaKore includes... Enumerating files and folders
The functionality of AllaKore includes: Gathering system information Enumerating files and folders
Its main functions include: Keylogger
Its main functions include: Keylogger Screenshots
Its main functions include: ... Steal clipboard data
uploads it to “https://kcps.edu[.]in/css/fonts/files/avena/” using the POST method
Opening the LNK triggers the MSHTA process, which executes a remote HTA file hosted on a compromised domain.
Creates the directory “C:\ProgramData\HP”, accesses the C2 to download data and saves it in “C:\ProgramData\HP\jquery.hta” and “C:\ProgramData\HP\jscy.hta” files, and then executes them.
Its main functions include: ... Remote control
both the final payloads... are executed and connected with the same IP but different port numbers for C2 communication... 6663, 9828... Crimson RAT... 9149, 15597, 18518, 26791, 28329.
concatenates it with the string "anvaro =," and uploads it to “https://kcps.edu[.]in/css/fonts/files/avena/” using the POST method.
106 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.