Loading malware…
ElectroRAT is a custom cross-platform remote access trojan written in Go and used in a long-running campaign targeting cryptocurrency users. It was distributed through trojanized cryptocurrency-themed applications, including trading and poker software, that were promoted via dedicated websites, fake forum personas, social media accounts, and paid promotion in cryptocurrency communities. The malware was compiled for Windows, Linux, and macOS and embedded inside Electron-based applications so that a decoy graphical interface appeared while the RAT operated covertly in the background.
ElectroRAT provides broad remote-access and surveillance functionality. Reported capabilities include remote command execution, file upload and download, keylogging, screenshot capture, and general victim monitoring. On macOS, documented variants also deployed embedded auxiliary components for webcam capture, Chrome credential theft, and VNC-based remote control, indicating a highly intrusive post-compromise toolset aimed at both financial theft and persistent operator access.
The malware established persistence on multiple platforms. On Linux, it has been observed creating a desktop autostart entry. On macOS, it has been observed copying itself into the user profile and registering a launch agent to execute automatically at login. ElectroRAT also retrieved command-and-control information from Pastebin-hosted content before connecting to attacker infrastructure.
The campaign appears to have been active from at least January 2020 and was notable for combining custom malware development with a coordinated social-engineering and marketing operation. The operation targeted cryptocurrency holders and traders, and reporting linked parts of the surrounding infrastructure to activity associated with Amadey and KPOT, although ElectroRAT itself was a distinct custom malware family rather than a reuse of those strains. Its low detection rates during the campaign contributed to its effectiveness against victims across desktop operating systems.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacker behind this operation has lured cryptocurrency users to download trojanized applications by promoting them in dedicated online forums and on social media.
ElectroRAT is extremely intrusive. It has various capabilities such as keylogging, taking screenshots, uploading files from disk, downloading files and executing commands on the victim’s console.
The promotional posts, published by fake users, tempted readers to browse the applications’ web pages, where they could download the application without knowing they were actually installing malware.
Once a victim runs the application, an innocent GUI will open, while ElectroRat runs hidden in the background as “mdworker”.
ElectroRAT is extremely intrusive. It has various capabilities such as keylogging, taking screenshots, uploading files from disk, downloading files and executing commands on the victim’s console.
ElectroRAT is extremely intrusive. It has various capabilities such as keylogging, taking screenshots, uploading files from disk, downloading files and executing commands on the victim’s console.
ElectroRAT is extremely intrusive. It has various capabilities such as keylogging, taking screenshots, uploading files from disk, downloading files and executing commands on the victim’s console.
ElectroRAT is extremely intrusive. It has various capabilities such as keylogging, taking screenshots, uploading files from disk, downloading files and executing commands on the victim’s console.
As part of its behavioral flow, ElectroRAT contacts raw pastebin pages to retrieve the C&C IP address.
ElectroRAT is extremely intrusive. It has various capabilities such as keylogging, taking screenshots, uploading files from disk, downloading files and executing commands on the victim’s console.
As part of its behavioral flow, ElectroRAT contacts raw pastebin pages to retrieve the C&C IP address.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.