Andaratm
Description
(AhnLab) Andaratm malware was used in attacks on military agencies in 2016, on ATMs and financial institutions in 2017, and on cryptocurrencyexchanges in 2018. 18 variants have been identified as of May 2018.The codesof Andaratm include strings such as ‘%s\cmd.exe /c echo | %s > %s’and ‘%s*****%s.’
When Andaratm is executed, it acquires information, such as the computer name and username, attempts to connect to the designated C2 server, and receives and executes the command.
The encryption method of Andaratm is similar to the methods generally used by malware.
Andaratm only executes simple commands, such as downloading files, uploading files, and running cmd.exe files.
Names
| Name |
|---|
| Andaratm |
Category
Malware
Type
- Backdoor
- Exfiltration
Information
Other Information
Uuid
e10666f4-2aa9-4405-bfcf-20ea4827fef2
Last Card Change
2020-04-20