Skip to main content

ElectroRAT Remote Access Trojan

ElectroRAT is a highly intrusive remote access trojan targeting cryptocurrency traders and gamblers, Written in Go, it is able to compromise Windows, macOS, and Linux environments.

Threat ID:
CC-3714
Category:
Trojan
Threat Severity:
Medium
Threat Vector:
Download
Published:
7 January 2021 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

ElectroRAT is a highly intrusive remote access trojan targeting cryptocurrency traders and gamblers, Written in Go, it is able to compromise Windows, macOS, and Linux environments.

Threat details

Introduction

First observed in January 2020, ElectroRAT is a Go-based cross-platform remote access trojan specifically targeting cryptocurrency applications and their users. 

Delivery

ElectroRAT is distributed in compromised versions of several Electron-based (hence it's name) cryptocurrency trading and betting applications. These applications are then hosted on attacker-controlled copies of legitimate cryptocurrency sites, links to which are then posted to a variety of cryptocurrency- and blockchain-related forums. Users then download and install the trojanised applications.

Activities

Once installed, ElectroRAT contacts a number of Pastebin pages to retrieve a list of command and control servers, before connecting to one of them and awaiting further commands.

By default, ElectroRAT is able to:

  • log keystrokes
  • record screen audio and video
  • download, execute, and transfer files
  • execute commands

Remediation advice

To prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Network indicators

IP addresses

  • 193[.]38[.]55[.]131
  • 193[.]38[.]55[.]4
  • 213[.]226[.]100[.]140

URLs

  • pastebin[.]com/raw/bfQiiqyv
  • pastebin[.]com/raw/DF8Gikrk
  • pastebin[.]com/raw/r12wBrC7
  • pastebin[.]com/raw/U45SvK4K
  • pastebin[.]com/raw/UbTZx6kd
  • pastebin[.]com/raw/zrZA4L3e
Host indicators

SHA256 file hashes

  • 13ac090fa99b1dce7f45e4aed07a0359b73815fc38dbe02bf976e088060990a8
  • 1416f8c40663d51191e8bd03c885e1f4f1c6b7c63d3068721bf386d621783917
  • 170cb5ea1a6b4af3c27358ba267a1309ed5118481619fc874f717262cb91fb77
  • 17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
  • 2ad12f75695ec4f63d7b35a79d118d7ed2eccc42f9cfa8fb75ec738f86f6ab99
  • 41ad7a6b8c410738ea8e826e503ec9bdd222a490db097b643cd94bbd62a12276
  • 568326883f9157fe8f1a7c681e2df341973a75205cf81d627040d101ce24f1bb
  • 5c884be3635eb55ce02e141d6fb07f760b6dbcace54f2217c69f287292ce59f6
  • 881be95a9632fa44deeeca23e4e19390d600ad817b2f66671d3f21453a16c7b7
  • a32ef780ba235f8222c05302f7537b4123c41b048449c6ec8744d64103d428a3
  • a4a68a51ed0a6ecf9146f75d405e50cfc58473d20220915b489b5fece03c4f55
  • c1aaf691608f1f2a0517e2c57cc4c6ff4e46d3ae1b592e939a0bc9b89a3a04cf
  • cf77727aa2cfcd3d6dd85cb492ddee28ff9191def60a9e00ea08ccddf817d143
  • da7c4975d75ffe17d6ff1352e239c6841d4b1523f9ea43c8124d732c48dfabba
  • ddd15dcc89416a61001c10ed9002df854fb4d92089e5388264b8af02654c778e
  • e547872761d81c3afc9c2a42cac3931e2a1defc2c56a0a3c57b28ea91e7686cd
  • e9b83d5cdefd4486b32a927d7505cdeebb43e6977759ba069d9373e46ca7d0f2

Last edited: 7 January 2021 2:46 pm