Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since this loader will read/write encrypted payload through a named pipe, we named this shellcode loader BigpipeLoader.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
In some cases, we also found that the group exploited publicly available applications to deploy and execute a simple downloader to download a shellcode loader and the necessary hack tools for the routine.
Since this loader will read/write encrypted payload through a named pipe, we named this shellcode loader BigpipeLoader ... Multi-threading decryption over named pipe
drops the malicious WTSAPI32.dll designed to be sideloaded by a legitimate application
Injecting a decrypted payload into the system built-in process (dllhost.exe or rundll32.exe) ... After restoring the ntdll, Symatic will spawn a new process for process injection.
Injecting a decrypted payload into the system built-in process (dllhost.exe or rundll32.exe) ... After restoring the ntdll, Symatic will spawn a new process for process injection.
drops the malicious WTSAPI32.dll designed to be sideloaded by a legitimate application
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.