Loading malware…
RONINGLOADER is a multi-stage Windows malware loader associated with Dragon Breath, also tracked as APT-Q-27 and GoldenEyeDog. It has been used in campaigns targeting Chinese-speaking users and organizations in sectors such as gambling and gaming, typically by disguising malicious installers as legitimate software including popular collaboration and browser applications. The loader has been documented delivering a modified Gh0st RAT variant as its final payload.
The infection chain commonly begins with trojanized MSI or NSIS installers that execute a benign application as a decoy while side-loading a malicious DLL and decrypting an embedded payload for in-memory execution. RONINGLOADER uses layered defense-evasion and execution techniques, including DLL side-loading, reflective loading, dynamic API resolution, process enumeration, thread-pool-based process injection, service creation, and watchdog-based persistence. It attempts to relaunch itself with elevated privileges when needed and has been observed disabling User Account Control and modifying firewall settings.
A defining characteristic of RONINGLOADER is its aggressive suppression of security tools. It has been reported scanning for and disrupting Microsoft Defender and several Chinese security products, including Qihoo 360, Huorong, Kingsoft, and Tencent protections. The malware abuses Protected Process Light mechanisms through ClipUp to corrupt or disable Microsoft Defender, deploys an unsigned Windows Defender Application Control policy to block selected security software, and uses a legitimately signed kernel driver to terminate protected security processes. It also employs phantom DLL side-loading and injection into trusted high-privilege processes such as TrustedInstaller to conceal execution and maintain control.
RONINGLOADER functions primarily as the delivery and evasion framework for Dragon Breath’s post-compromise activity. The final Gh0st RAT payload provides remote access and supports command execution, keylogging, clipboard theft and hijacking, active-window logging, payload delivery, and event-log clearing. The loader’s design shows redundancy across multiple evasion paths so that the operation can continue even if one disabling technique fails.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Elastic Security Labs detailed the adversary's use of a multi-stage loader codenamed RONINGLOADER to distribute a Gh0st RAT variant through NSIS installers masquerading as legitimate programs like Google Chrome and Microsoft Teams.
Through this report, we hope to raise awareness of new techniques this malware is starting to implement and to shine a light on a unique loader we are naming RoningLoader.
Through this report, we hope to raise awareness of new techniques this malware is starting to implement and to shine a light on a unique loader we are naming RoningLoader.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Note that all of the system commands executed are through cmd.exe with the ShellExecuteW API
1.bat is a simple batch script that disables User Account Control (UAC) by setting the EnableLUA registry value to 0 ... Set registry key Enable to False to terminate & disable implant persistently ... Configuration parameters are stored in the registry under HKEY_CURRENT_USER\offlinekey
it calls a function to inject shellcode into the process ( vssvc.exe ) ... This technique leverages the thread pool to remotely execute code ... it injects another shellcode into svchost.exe ... writes to it with WriteProcessMemory , and then creates a remote thread to execute it with CreateRemoteThread
The malware then injects code into regsvr32.exe — a native Windows utility — using CreateRemoteThread and LoadLibrary (T1055.001), pushing execution into high-privilege processes like TrustedInstaller.exe to conceal its activity further.
It first grants itself the high integrity SeDebugPrivilege token.
RONINGLOADER to distribute a Gh0st RAT variant through NSIS installers masquerading as legitimate programs like Google Chrome and Microsoft Teams.
it calls a function to inject shellcode into the process ( vssvc.exe ) ... This technique leverages the thread pool to remotely execute code ... it injects another shellcode into svchost.exe ... writes to it with WriteProcessMemory , and then creates a remote thread to execute it with CreateRemoteThread
The malware then injects code into regsvr32.exe — a native Windows utility — using CreateRemoteThread and LoadLibrary (T1055.001), pushing execution into high-privilege processes like TrustedInstaller.exe to conceal its activity further.
1.bat is a simple batch script that disables User Account Control (UAC) by setting the EnableLUA registry value to 0 ... Set registry key Enable to False to terminate & disable implant persistently ... Configuration parameters are stored in the registry under HKEY_CURRENT_USER\offlinekey
The malware directly targets Windows Defender Application Control (WDAC) by writing a policy file to the path C:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\{31351756-3F24-4963-8380-4E7602335AAE}.cip ... Enabled:Unsigned System Integrity Policy rule, which allows the policy to be loaded without a valid digital signature.
If not, it attempts to elevate its privileges ... BeaconData { ... uint8_t is_admin ... }
The malware employs an abuse of Protected Process Light (PPL) to disable Windows Defender ... threat actors leverage a valid, signed kernel driver to kill processes ... Custom unsigned WDAC policy applied to block 360 Total Security and Huorong executables
First, it blocks all network communication by changing the firewall ... fhq.bat is another batch script that targets ... 360Safe.exe by creating firewall rules that block inbound and outbound connections to them. It also disables firewall notifications across all profiles.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-stage loader used to distribute a Gh0st RAT variant via trojanized NSIS installers masquerading as legitimate software.
A multi-stage malware loader delivered via trojanized NSIS installers. It uses DLL side-loading, in-memory shellcode execution, code injection, privilege escalation, UAC disabling, and a signed kernel driver to disable security tools before deploying a final payload.
Multi-stage loader used to disable security tools and deliver a modified Gh0st RAT payload.
A loader associated with the DragonBreath actor, discussed in the context of abusing PPL (Protected Process Light) mechanisms.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.