Exaramel for Windows

Executive Summary

Exaramel is a stealthy Windows backdoor capable of remote command execution and data exfiltration. It persists via registry or task scheduler entries and communicates over encrypted channels to evade traffic‑based detection. Effective defense requires explicit host rules and blocking known C2 IPs/domains.

Exaramel for Windows is a remote‑access trojan (RAT) that was first reported by ESET in October 2018 as part of the TeleBots family. The malware installs a backdoor component on infected machines, allowing adversaries to execute arbitrary commands, collect system information, and exfiltrate data over an encrypted channel. Typical installation follows a persistent entry point via registry Run keys or scheduled tasks, after which the agent opens an outbound connection to a command‑and‑control (C2) server. Once in place it can launch PowerShell scripts, download additional payloads, or manipulate files and registry settings to maintain foothold and evade detection. Because Exaramel operates primarily through standard system utilities and encrypted traffic, defensive layers often miss it unless host‑based intrusion detection rules are explicitly configured. The Windows variant specifically targets the Windows API, making use of DLL injection techniques for privileged command execution when needed.

Key Capabilities

• Remote command execution (PowerShell, CMD)
• Persistence via Run keys / scheduled tasks
• Encrypted outbound C2 communication
• Dynamic download of additional payloads
• Registry manipulation for privilege escalation

ATT&CK Techniques

Recommended Actions

• Deploy host‑based IDS/IPS signatures targeting Exaramel binaries and YARA rules
• Block known Exaramel C2 domains/IPs at the perimeter
• Implement least‑privilege policies to reduce impact of lateral movement
• Monitor for anomalous outbound HTTPS traffic from endpoint processes
• Apply timely patches and update anti‑malware engines

Suggested Tags