SYMBOLCOMMON_NAMEaka. SYNONYMS
win.allakore (Back to overview)

AllaKore

AllaKore is a simple Remote Access Tool written in Delphi, first observed in 2015 but still in early stages of development. It implements the RFB protocol which uses frame buffers and thus is able to send back only the changes of screen frames to the controller, speeding up the transport and visualization control.

References
2023-11-06 ⋅ Seqrite ⋅ Sathwik Ram Prakki
@online{prakki:20231106:sidecopys:03c64cf, author = {Sathwik Ram Prakki}, title = {{SideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT}}, date = {2023-11-06}, organization = {Seqrite}, url = {https://www.seqrite.com/blog/sidecopys-multi-platform-onslaught-leveraging-winrar-zero-day-and-linux-variant-of-ares-rat/}, language = {English}, urldate = {2023-11-13} } SideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT
Action RAT AllaKore
2023-04-19 ⋅ Team Cymru ⋅ S2 Research Team
@online{team:20230419:allakored:9832ba9, author = {S2 Research Team}, title = {{AllaKore(d) the SideCopy Train}}, date = {2023-04-19}, organization = {Team Cymru}, url = {https://www.team-cymru.com/post/allakore-d-the-sidecopy-train}, language = {English}, urldate = {2023-04-22} } AllaKore(d) the SideCopy Train
AllaKore
2023 ⋅ ThreatMon ⋅ ThreatMon Malware Research Team, Seyit Sigirci (@h3xecute)
@online{team:2023:anatomy:bf2e58a, author = {ThreatMon Malware Research Team and Seyit Sigirci (@h3xecute)}, title = {{The Anatomy of a Sidecopy Attack: From RAR Exploits to AllaKore RAT}}, date = {2023}, organization = {ThreatMon}, url = {https://threatmon.io/the-anatomy-of-a-sidecopy-attack-from-rar-exploits-to-allakore-rat/}, language = {English}, urldate = {2023-11-22} } The Anatomy of a Sidecopy Attack: From RAR Exploits to AllaKore RAT
AllaKore
2021-10-26 ⋅ Kaspersky ⋅ Kaspersky Lab ICS CERT
@techreport{cert:20211026:attacks:6f30d0f, author = {Kaspersky Lab ICS CERT}, title = {{APT attacks on industrial organizations in H1 2021}}, date = {2021-10-26}, institution = {Kaspersky}, url = {https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf}, language = {English}, urldate = {2021-11-08} } APT attacks on industrial organizations in H1 2021
8.t Dropper AllaKore AsyncRAT GoldMax LimeRAT NjRAT NoxPlayer Raindrop ReverseRAT ShadowPad Zebrocy
2021-07-07 ⋅ Talos ⋅ Asheer Malhotra, Justin Thattil
@online{malhotra:20210707:insidecopy:ac5b778, author = {Asheer Malhotra and Justin Thattil}, title = {{InSideCopy: How this APT continues to evolve its arsenal (Network IOCs)}}, date = {2021-07-07}, organization = {Talos}, url = {https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479}, language = {English}, urldate = {2021-07-09} } InSideCopy: How this APT continues to evolve its arsenal (Network IOCs)
AllaKore Lilith NjRAT
2021-07-07 ⋅ Talos ⋅ Asheer Malhotra, Justin Thattil
@online{malhotra:20210707:insidecopy:e6b25bb, author = {Asheer Malhotra and Justin Thattil}, title = {{InSideCopy: How this APT continues to evolve its arsenal (IOCs)}}, date = {2021-07-07}, organization = {Talos}, url = {https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt}, language = {English}, urldate = {2021-07-09} } InSideCopy: How this APT continues to evolve its arsenal (IOCs)
AllaKore Lilith NjRAT
2021-07-07 ⋅ Talos Intelligence ⋅ Asheer Malhotra, Justin Thattil
@online{malhotra:20210707:insidecopy:eca169d, author = {Asheer Malhotra and Justin Thattil}, title = {{InSideCopy: How this APT continues to evolve its arsenal}}, date = {2021-07-07}, organization = {Talos Intelligence}, url = {https://blog.talosintelligence.com/2021/07/sidecopy.html}, language = {English}, urldate = {2021-07-08} } InSideCopy: How this APT continues to evolve its arsenal
AllaKore NjRAT SideCopy
2021-07-07 ⋅ Talos ⋅ Asheer Malhotra, Justin Thattil
@techreport{malhotra:20210707:insidecopy:107d438, author = {Asheer Malhotra and Justin Thattil}, title = {{InSideCopy: How this APT continues to evolve its arsenal}}, date = {2021-07-07}, institution = {Talos}, url = {https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf}, language = {English}, urldate = {2021-07-09} } InSideCopy: How this APT continues to evolve its arsenal
AllaKore Lilith NjRAT
2021-07-02 ⋅ Cisco ⋅ Asheer Malhotra, Justin Thattil
@online{malhotra:20210702:insidecopy:c85188c, author = {Asheer Malhotra and Justin Thattil}, title = {{InSideCopy: How this APT continues to evolve its arsenal}}, date = {2021-07-02}, organization = {Cisco}, url = {https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388}, language = {English}, urldate = {2022-01-25} } InSideCopy: How this APT continues to evolve its arsenal
AllaKore CetaRAT Lilith NjRAT ReverseRAT
2020-09-23 ⋅ Seqrite ⋅ Kalpesh Mantri, Pawan CHaudhari, Goutam Tripathy
@techreport{mantri:20200923:operation:1bb33e6, author = {Kalpesh Mantri and Pawan CHaudhari and Goutam Tripathy}, title = {{Operation SideCopy: An insight into Transparent Tribe’s sub-division which has been incorrectly attributed for years}}, date = {2020-09-23}, institution = {Seqrite}, url = {https://www.seqrite.com/documents/en/white-papers/Seqrite-WhitePaper-Operation-SideCopy.pdf}, language = {English}, urldate = {2020-09-25} } Operation SideCopy: An insight into Transparent Tribe’s sub-division which has been incorrectly attributed for years
CACTUSTORCH AllaKore
2019-12-31 ⋅ Twitter (@_re_fox) ⋅ _re_fox
@online{refox:20191231:allakore:22a8e0a, author = {_re_fox}, title = {{Tweet on AllaKore indicators}}, date = {2019-12-31}, organization = {Twitter (@_re_fox)}, url = {https://twitter.com/_re_fox/status/1212070711206064131}, language = {English}, urldate = {2020-01-06} } Tweet on AllaKore indicators
AllaKore
2019-07-08 ⋅ Medium Sebdraven ⋅ Sébastien Larinier
@online{larinier:20190708:copy:99b120f, author = {Sébastien Larinier}, title = {{Copy cat of APT Sidewinder ?}}, date = {2019-07-08}, organization = {Medium Sebdraven}, url = {https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d}, language = {English}, urldate = {2023-04-22} } Copy cat of APT Sidewinder ?
AllaKore SideCopy
2015-10-19 ⋅ Github (Anderson-D) ⋅ Anderson D
@online{d:20151019:github:b15ea7e, author = {Anderson D}, title = {{Github Repository for AllaKore}}, date = {2015-10-19}, organization = {Github (Anderson-D)}, url = {https://github.com/Anderson-D/AllaKore}, language = {English}, urldate = {2020-01-08} } Github Repository for AllaKore
AllaKore

There is no Yara-Signature yet.