Malware Analysis Report (MAR) - 10135536-F

This DHS/FBI Malware Analysis Report details HIDDEN COBRA (North Korean) tooling called HARDRAIN: two 32-bit Windows DLLs used to open firewall ports and operate as proxy servers that emulate TLS using embedded legitimate SSL certificates, and an ARM ELF Android Remote Access Tool. The report includes sample hashes, AV detections, YARA signature, extracted certificate strings and non-malicious domain references, and offers mitigation and reporting guidance to help defenders detect and remediate this nation-state backdoor activity.