ELECTRICFISH (Malware Family)

ELECTRICFISH

VTCollection

The application is a command-line utility and its primary purpose is to tunnel traffic between two IP addresses. The application accepts command-line arguments allowing it to be configured with a destination IP address and port, a source IP address and port, a proxy IP address and port, and a user name and password, which can be utilized to authenticate with a proxy server. It will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to both the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to rapidly and efficiently be tunneled between two machines. If necessary, the malware can authenticate with a proxy to be able to reach the destination IP address. A configured proxy server is not required for this utility.

References

2020-05-04 ⋅ ADEO DFIR ⋅ ADEO DFIR
APT38 Lazarus Threat Analysis Report
BLINDTOAD ELECTRICFISH

2020-02-19 ⋅ Lexfo ⋅ Lexfo
The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor

2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy

2019-05-09 ⋅ CISA ⋅ CISA
Malware Analysis Report (AR19-129A)
ELECTRICFISH Lazarus Group

Yara Rules

[TLP:WHITE] win_electricfish_auto (20260917 | Detects win.electricfish.)

rule win_electricfish_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.electricfish."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 8bf8 57 55 e8???????? 68a2010000 68???????? }
            // n = 7, score = 1200
            //   e8????????           |                     
            //   8bf8                 | mov                 edi, eax
            //   57                   | push                edi
            //   55                   | push                ebp
            //   e8????????           |                     
            //   68a2010000           | push                0x1a2
            //   68????????           |                     

        $sequence_1 = { 740d 8b6810 85ed 7406 896c2418 eb0c c744241800000000 }
            // n = 7, score = 1200
            //   740d                 | je                  0xf
            //   8b6810               | mov                 ebp, dword ptr [eax + 0x10]
            //   85ed                 | test                ebp, ebp
            //   7406                 | je                  8
            //   896c2418             | mov                 dword ptr [esp + 0x18], ebp
            //   eb0c                 | jmp                 0xe
            //   c744241800000000     | mov                 dword ptr [esp + 0x18], 0

        $sequence_2 = { e8???????? 8bf0 3bf7 0f8413020000 53 55 56 }
            // n = 7, score = 1200
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   3bf7                 | cmp                 esi, edi
            //   0f8413020000         | je                  0x219
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   56                   | push                esi

        $sequence_3 = { 7421 6881010000 68???????? 68e2000000 68e6000000 6a0d }
            // n = 6, score = 1200
            //   7421                 | je                  0x23
            //   6881010000           | push                0x181
            //   68????????           |                     
            //   68e2000000           | push                0xe2
            //   68e6000000           | push                0xe6
            //   6a0d                 | push                0xd

        $sequence_4 = { e8???????? 8bf0 83c404 897704 85f6 7511 6822010000 }
            // n = 7, score = 1200
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   83c404               | add                 esp, 4
            //   897704               | mov                 dword ptr [edi + 4], esi
            //   85f6                 | test                esi, esi
            //   7511                 | jne                 0x13
            //   6822010000           | push                0x122

        $sequence_5 = { 6841010000 68???????? 52 e8???????? 8b44241c 83c40c 5f }
            // n = 7, score = 1200
            //   6841010000           | push                0x141
            //   68????????           |                     
            //   52                   | push                edx
            //   e8????????           |                     
            //   8b44241c             | mov                 eax, dword ptr [esp + 0x1c]
            //   83c40c               | add                 esp, 0xc
            //   5f                   | pop                 edi

        $sequence_6 = { 8bc5 2bc6 83f804 0f8291f8ffff }
            // n = 4, score = 1200
            //   8bc5                 | mov                 eax, ebp
            //   2bc6                 | sub                 eax, esi
            //   83f804               | cmp                 eax, 4
            //   0f8291f8ffff         | jb                  0xfffff897

        $sequence_7 = { e8???????? 83c420 e9???????? 6858010000 68???????? 6a41 68bb000000 }
            // n = 7, score = 1200
            //   e8????????           |                     
            //   83c420               | add                 esp, 0x20
            //   e9????????           |                     
            //   6858010000           | push                0x158
            //   68????????           |                     
            //   6a41                 | push                0x41
            //   68bb000000           | push                0xbb

        $sequence_8 = { 89a51cffffff 6aff 894110 c741140f000000 50 8801 }
            // n = 6, score = 1200
            //   89a51cffffff         | mov                 dword ptr [ebp - 0xe4], esp
            //   6aff                 | push                -1
            //   894110               | mov                 dword ptr [ecx + 0x10], eax
            //   c741140f000000       | mov                 dword ptr [ecx + 0x14], 0xf
            //   50                   | push                eax
            //   8801                 | mov                 byte ptr [ecx], al

        $sequence_9 = { e9???????? 68???????? 68???????? e8???????? 83c408 8bf0 e8???????? }
            // n = 7, score = 1200
            //   e9????????           |                     
            //   68????????           |                     
            //   68????????           |                     
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8bf0                 | mov                 esi, eax
            //   e8????????           |                     

    condition:
        7 of them and filesize < 3162112
}

[TLP:WHITE] win_electricfish_w0 (20190815 | HiddenCobraElectricFish)

rule win_electricfish_w0 {   
      meta:   
          author = "AlienVault Labs"   
          type = "malware"   
          description = "HiddenCobraElectricFish"   
          copyright = "Alienvault Inc. 2019"   
          reference = "a3a1a43f0e631c10ab42e5404b61580e760e7d6f849ab8eb5848057a8c60cda2,7efe8a7ad9c6a6146bddd5aef9ceba477ca6973203a41f4b7f823095a90cb10f"   
          malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
          malpedia_version = "20190815"
          malpedia_license = "CC BY-NC-SA 4.0"
          malpedia_sharing = "TLP:WHITE"
      strings:   
          $x1 = "CCGC_LOG ===>"   
          $x2 = "<==RECV==="   
          $x3 = "aaaabbbbccccdddd"   
      condition:   
           uint16(0) == 0x5a4d and all of them   
}

Download all Yara Rules

ELECTRICFISH Propose Change

References

Yara Rules

ELECTRICFISH