SYMBOLCOMMON_NAMEaka. SYNONYMS
win.electricfish (Back to overview)

ELECTRICFISH

Actor(s): Lazarus Group

VTCollection    

The application is a command-line utility and its primary purpose is to tunnel traffic between two IP addresses. The application accepts command-line arguments allowing it to be configured with a destination IP address and port, a source IP address and port, a proxy IP address and port, and a user name and password, which can be utilized to authenticate with a proxy server. It will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to both the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to rapidly and efficiently be tunneled between two machines. If necessary, the malware can authenticate with a proxy to be able to reach the destination IP address. A configured proxy server is not required for this utility.

References
2020-05-04 ⋅ ADEO DFIR ⋅ ADEO DFIR
APT38 Lazarus Threat Analysis Report
BLINDTOAD ELECTRICFISH
2020-02-19 ⋅ Lexfo ⋅ Lexfo
The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2019-05-09 ⋅ CISA ⋅ CISA
Malware Analysis Report (AR19-129A)
ELECTRICFISH Lazarus Group
Yara Rules
[TLP:WHITE] win_electricfish_auto (20260504 | Detects win.electricfish.)
rule win_electricfish_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.electricfish."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3bc3 7438 6a7e 68???????? 50 e8???????? 83c40c }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   7438                 | je                  0x3a
            //   6a7e                 | push                0x7e
            //   68????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_1 = { 3bc3 7417 50 e8???????? 83c404 898608020000 3bc3 }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   7417                 | je                  0x19
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   898608020000         | mov                 dword ptr [esi + 0x208], eax
            //   3bc3                 | cmp                 eax, ebx

        $sequence_2 = { 3bc3 7421 395f04 747b 68c2000000 68???????? 6a08 }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   7421                 | je                  0x23
            //   395f04               | cmp                 dword ptr [edi + 4], ebx
            //   747b                 | je                  0x7d
            //   68c2000000           | push                0xc2
            //   68????????           |                     
            //   6a08                 | push                8

        $sequence_3 = { 3bc3 741d 8b87b0010000 3bc3 741e 50 }
            // n = 6, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   741d                 | je                  0x1f
            //   8b87b0010000         | mov                 eax, dword ptr [edi + 0x1b0]
            //   3bc3                 | cmp                 eax, ebx
            //   741e                 | je                  0x20
            //   50                   | push                eax

        $sequence_4 = { 3bc3 7413 50 e8???????? 83c404 89861c020000 3bc3 }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   7413                 | je                  0x15
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   89861c020000         | mov                 dword ptr [esi + 0x21c], eax
            //   3bc3                 | cmp                 eax, ebx

        $sequence_5 = { 3bc3 741a 8b8edc000000 8d542470 89442478 894c2470 895c247c }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   741a                 | je                  0x1c
            //   8b8edc000000         | mov                 ecx, dword ptr [esi + 0xdc]
            //   8d542470             | lea                 edx, [esp + 0x70]
            //   89442478             | mov                 dword ptr [esp + 0x78], eax
            //   894c2470             | mov                 dword ptr [esp + 0x70], ecx
            //   895c247c             | mov                 dword ptr [esp + 0x7c], ebx

        $sequence_6 = { 3bc3 741e 50 e8???????? 83c404 898618020000 3bc3 }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   741e                 | je                  0x20
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   898618020000         | mov                 dword ptr [esi + 0x218], eax
            //   3bc3                 | cmp                 eax, ebx

        $sequence_7 = { 3bc3 7429 395860 7424 8b4c2414 51 8b4c2424 }
            // n = 7, score = 1200
            //   3bc3                 | cmp                 eax, ebx
            //   7429                 | je                  0x2b
            //   395860               | cmp                 dword ptr [eax + 0x60], ebx
            //   7424                 | je                  0x26
            //   8b4c2414             | mov                 ecx, dword ptr [esp + 0x14]
            //   51                   | push                ecx
            //   8b4c2424             | mov                 ecx, dword ptr [esp + 0x24]

    condition:
        7 of them and filesize < 3162112
}
[TLP:WHITE] win_electricfish_w0   (20190815 | HiddenCobraElectricFish)
rule win_electricfish_w0 {   
      meta:   
          author = "AlienVault Labs"   
          type = "malware"   
          description = "HiddenCobraElectricFish"   
          copyright = "Alienvault Inc. 2019"   
          reference = "a3a1a43f0e631c10ab42e5404b61580e760e7d6f849ab8eb5848057a8c60cda2,7efe8a7ad9c6a6146bddd5aef9ceba477ca6973203a41f4b7f823095a90cb10f"   
          malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
          malpedia_version = "20190815"
          malpedia_license = "CC BY-NC-SA 4.0"
          malpedia_sharing = "TLP:WHITE"
      strings:   
          $x1 = "CCGC_LOG ===>"   
          $x2 = "<==RECV==="   
          $x3 = "aaaabbbbccccdddd"   
      condition:   
           uint16(0) == 0x5a4d and all of them   
}
Download all Yara Rules