AllaKore

AllaKore is a publicly available Delphi-based remote access trojan that has been repeatedly used as a foundation or commodity component in multiple intrusion sets. It is notably associated with campaigns targeting Latin America, especially Brazil and Mexico, and has also appeared in South Asia-focused operations linked to SideCopy. The malware’s open-source availability has enabled extensive reuse, modification, and derivative development, including banking-focused variants such as AllaSenha and later descendants in the same lineage.

AllaKore provides remote access functionality and has been used to support interactive control of infected Windows systems. Reported capabilities in AllaKore-derived campaigns include credential theft, keylogging, remote desktop or keyboard-and-mouse control, reconnaissance of host information, persistence, and exfiltration of victim data. In banking-focused variants derived from the AllaKore ecosystem, operators have implemented overlays and workflows aimed at stealing online banking credentials and two-factor authentication artifacts, including QR-code-based payment authorization data, particularly against Brazilian financial institutions.

Observed delivery chains associated with AllaKore and its variants commonly rely on phishing lures themed around Brazilian electronic invoices or tax documents, often using malicious shortcut files, script launchers, WebDAV abuse, embedded Python stages, and in-memory DLL loading to evade detection. In other operations, AllaKore has been delivered alongside other malware families such as SystemBC. SideCopy has also used AllaKore in campaigns targeting Indian government-related entities, typically through multi-stage loader chains involving malicious shortcuts and script-based execution.

The malware primarily targets Windows environments. Across campaigns, AllaKore and its descendants have been used against financial-sector victims, government personnel, and other organizations of strategic interest. Its continued appearance in active campaigns, along with the emergence of customized descendants, indicates that AllaKore remains an adaptable and operationally relevant RAT framework rather than merely a historical open-source project.