SYMBOLCOMMON_NAMEaka. SYNONYMS
win.elmachete_dropper_2022 (Back to overview)

El Machete APT Backdoor Dropper

Actor(s): El Machete

This dropper masquerades itself as Adobe software, titled as Adobe.msi. It is used to executes the python written Backdoor used by this threat actor.

References
2022-03-31 ⋅ Check Point Research
State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage
Loki RAT El Machete APT Backdoor Dropper Lyceum .NET DNS Backdoor Lyceum .NET TCP Backdoor Lyceum Golang HTTP Backdoor

There is no Yara-Signature yet.