Exaramel for Windows — Malware Profile

Exaramel for Windows is a backdoor used for targeting Windows systems. The Linux version is tracked separately under Exaramel for Linux.

MITRE ATT&CK techniques (8)

• T1027.011 Fileless Storage
• T1036.004 Masquerade Task or Service
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1074.001 Local Data Staging
• T1112 Modify Registry
• T1543.003 Windows Service
• T1560 Archive Collected Data

Attributed threat actors

• Sandworm Team

Read the full analysis on IntelFusions