H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Exaramel for Linux

[Exaramel for Linux](https://attack.mitre.org/software/S0401) is a backdoor written in the Go Programming Language and compiled as a 64-bit ELF binary. The Windows version is tracked separately under [Exaramel for Windows](https://attack.mitre.org/software/S0343).(Citation: ESET TeleBots Oct 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Exaramel for Linux](https://attack.mitre.org/software/S0401) is a backdoor written in the Go Programming Language and compiled as a 64-bit ELF binary. The Windows version is tracked separately under [Exaramel for Windows](https://attack.mitre.org/software/S0343).(Citation: ESET TeleBots Oct 2018)

Labels

malware
13 recorded

Relationships

uses
to Create or Modify System Process
Technique
uses
to Cron
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Fallback Channels
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Setuid and Setgid
Technique
uses
to Systemd Service
Technique
uses
to System Owner/User Discovery
Technique
uses
to Unix Shell
Technique
uses
to Web Protocols
Technique
uses
from Sandworm Team
Group
3 external

References

mitre-attack
S0401
open
Exaramel for Linux
—
ESET TeleBots Oct 2018
https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance