HARDRAIN

Description

(US-CERT) This report provides analysis of three (3) malicious executable files. The first two (2) files are 32-bit Windows executables that function as Proxy servers and implement a ‘Fake TLS’ method similar to the behavior described in a previously published NCCIC report, MAR-10135536-B. The third file is an Executable Linkable Format (ELF) file designed to run on Android platforms as a fully functioning Remote Access Tool (RAT).

Names

Name
HARDRAIN

Category

Malware

Type

• Backdoor
• Tunneling

Information

• https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf

Mitre Attack

• https://attack.mitre.org/software/S0246/

Malpedia

• https://malpedia.caad.fkie.fraunhofer.de/details/apk.hardrain
• https://malpedia.caad.fkie.fraunhofer.de/details/win.hardrain

Alienvault Otx

• https://otx.alienvault.com/browse/pulses?q=tag:HARDRAIN

Other Information

Uuid

c8c2fb9c-d95d-4af7-9b76-bb911985b367

Last Card Change

2020-04-22