Trusted Design

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

概要

Elirks, less widely known than PlugX, is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems. We mostly observe attacks using Elirks occurring in East Asia. One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor. We have seen multiple Elirks variants using Japanese blog services for the last couple of years. Figure 1 shows embedded URL in an Elirks sample found in early 2016.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520 -
• FileHash-SHA256 - 631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3 -
• FileHash-SHA256 - 9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5 -
• YARA - f42b576c3b5d8cd9275eb68b3cf0fffa71d5f843 -
• FileHash-SHA256 - 12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d -
• CVE - CVE-2012-0611 -
• FileHash-SHA256 - 3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90 -
• FileHash-SHA256 - 7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8 -
• FileHash-SHA256 - 53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e -
• FileHash-SHA256 - 755138308bbaa9fcb9c60f0b089032ed4fa1cece830a954ad574bd0c2fe1f104 -
• FileHash-SHA256 - 200a4708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02e60a2 -
• FileHash-SHA256 - 523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b -
• YARA - 1b4ec745b3129350b0b1ff92714615dba8cde2cd -
• FileHash-SHA256 - 41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33 -
• FileHash-SHA256 - 0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95 -
• FileHash-SHA256 - 8587e3a0312a6c4374989cbcca48dc54ddcd3fbd54b48833afda991a6a2dfdea -
• FileHash-SHA256 - 4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3 -
• FileHash-SHA256 - 53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60 -
• CVE - CVE-2011-0611 -
• FileHash-SHA256 - f18ddcacfe4a98fb3dd9eaffd0feee5385ffc7f81deac100fdbbabf64233dc68 -

類似Pulses

• Chinese Actors attacks on US Government and EU Media (score: 0.64)
• LeetMX – a Yearlong Cyber-Attack Campaign Against Targets in Latin America (score: 0.63)
• Campaign on the Government of Thailand Delivers Bookworm Trojan (score: 0.63)
• Affiliate’s Malspam Operation: Kovter and Miuref/Boaxxe (score: 0.60)
• Taiwan targeted with new cyberespionage backdoor Trojan (score: 0.59)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る