Malware

Exaramel for Windows

Exaramel for Windows is a Windows backdoor associated with the Exaramel malware family. It supports remote command execution, including launching a remote shell and executing VBScript on compromised hosts. The malware stores its configuration in the Windows Registry in XML format, indicating an effort to persist operational settings and reduce reliance on obvious on-disk configuration files. A related dropper establishes persistence by creating and starting a Windows service while masquerading as a legitimate security-related component. Exaramel for Windows also stages files for theft and automatically encrypts files before transmitting them to command-and-control infrastructure, demonstrating built-in data collection and exfiltration support. The observed behavior is consistent with a post-compromise backdoor used for persistence, remote tasking, and covert data theft on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence4

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1059.005Visual BasicEvidence3

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

Persistence

2 techniques

T1112Modify RegistryEvidence9

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543.003Windows ServiceEvidence3

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence3

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

"ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration."; "Agent Tesla can encrypt data with 3DES..."; "APT32's backdoor has used...RC4 encryption before exfiltration."; "Epic encrypts collected data using a public key framework..."; "Some variants encrypt...with AES and encode it with base64..."; "Prikormka...encrypts it with Blowfish."; "VERMIN encrypts the collected files using 3-DES."; "Zebrocy...RC4...as well as AES...and hexadecimal for encoding"

T1027.011Fileless StorageEvidence2

Examples include: “ComRAT has encrypted and stored its orchestrator code in the Registry…”, “ShadowPad maintains a configuration block and virtual file system in the Registry.”, and “QakBot can store its configuration information…under HKCU\Software\Microsoft.”

T1036MasqueradingEvidence1

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.

T1036.004Masquerade Task or ServiceEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence9

Collection

3 techniques

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

T1560Archive Collected DataEvidence2

"AppleSeed has compressed collected data before exfiltration."; "APT28 used a publicly available tool to gather and compress multiple documents..."; "Aria-body has used ZIP to compress data..."; "Cadelspy...compress stolen data into a .cab file."; "Daserf hides collected data in password-protected .rar archives."; "FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration."; "Lazarus Group has compressed exfiltrated data with RAR...archive specified directories in .zip format"; "XCSSET will compress entire ~/Desktop folders..."

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

Impact

1 technique

T1565Data ManipulationEvidence1

ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®

Includes a command to execute VBS scripts on victim machines.

mitre attack websiteNews

Oct 21, 2021

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Windows backdoor that stores configuration in XML format within the Registry.

mitre attack websiteNews

Mar 8, 2018

Create or Modify System Process: Windows Service, Sub-technique T1543.003 - Enterprise | MITRE ATT&CK®

Windows backdoor whose dropper creates and starts a masqueraded Windows service.

mitre attack websiteNews

Mar 7, 2018

Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®

Malware with functionality to execute VBS scripts on victim machines.

+14 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Exaramel for Windows