Skip to content

S0401 Exaramel for Linux

Exaramel for Linux is a backdoor written in the Go Programming Language and compiled as a 64-bit ELF binary. The Windows version is tracked separately under Exaramel for Windows.1

Item Value
ID S0401
Associated Names
Version 1.2
Created 26 August 2019
Last Modified 14 April 2021
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1548 Abuse Elevation Control Mechanism -
enterprise T1548.001 Setuid and Setgid Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.2
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols Exaramel for Linux uses HTTPS for C2 communications.12
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.004 Unix Shell Exaramel for Linux has a command to execute a shell command on the system.12
enterprise T1543 Create or Modify System Process Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.2
enterprise T1543.002 Systemd Service Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.12
enterprise T1140 Deobfuscate/Decode Files or Information Exaramel for Linux can decrypt its configuration file.2
enterprise T1008 Fallback Channels Exaramel for Linux can attempt to find a new C2 server if it receives an error.2
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.2
enterprise T1105 Ingress Tool Transfer Exaramel for Linux has a command to download a file from and to a remote C2 server.12
enterprise T1027 Obfuscated Files or Information Exaramel for Linux uses RC4 for encrypting the configuration.12
enterprise T1053 Scheduled Task/Job -
enterprise T1053.003 Cron Exaramel for Linux uses crontab for persistence if it does not have root privileges.12
enterprise T1033 System Owner/User Discovery Exaramel for Linux can run whoami to identify the system owner.2

Groups That Use This Software

ID Name References
G0034 Sandworm Team 12