Malware
Alreay
Alreay is a remote access trojan that uses HTTP(S) or TCP for communication with its C&C server.
Alreay is a Windows malware family operated by Lazarus Group.
Background
Alreay is a remote access trojan that reaches its C&C server over HTTP(S) or TCP.
Its configuration is held in the registry and protected with either RC4 or DES encryption.
The trojan reports extensive details about the victim's environment, including the computer name, Windows version, system locale, and network configuration.
It implements close to 25 commands covering filesystem operations, basic process management, file exfiltration, command-line execution, and injection of an executable pulled from the attacker's C&C server. As is common across Lazarus RATs, these commands are referenced by 32-bit integer indices such as 0x21A8B293, 0x23FAE29C, and 0x91B93485.
Alreay ships either as an EXE or as a DLL whose internal name is t_client_dll.dll, and it may statically link code from open-source libraries like Mbed TLS or zLib (version 1.0.1).
The RAT was seen during 2016-2017 operating on the networks of banks that ran SWIFT Alliance software.
Source: Malpedia (Fraunhofer FKIE).