ELECTRICFISH
- First seen
- 2019-05-09 00:00:00
- Malware type
- trojan
- Profile updated
- 2026-07-07 12:46:34
Targeted industries: government-and-public-sector
Targeted regions: country_code:us
Context
The application is a command-line utility and its primary purpose is to tunnel traffic between two IP addresses. The application accepts command-line arguments allowing it to be configured with a destination IP address and port, a source IP address and port, a proxy IP address and port, and a user name and password, which can be utilized to authenticate with a proxy server. It will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to both the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to rapidly and efficiently be tunneled between two machines. If necessary, the malware can authenticate with a proxy to be able to reach the destination IP address. A configured proxy server is not required for this utility.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Electricfish_Auto (yara-rule)
Reports & references
- us-cert.gov — Ar19 129A (report)
- ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
- blog.lexfo.fr — Lexfo Whitepaper The Lazarus Constellation (report)
- adeo.com.tr — Adeo Lazarus Apt38 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Electricfish (report)