Malware

Pisloader

Pisloader is a Windows malware family used for command-and-control operations and host reconnaissance. Observed behavior includes establishing persistence through a Registry Run key, collecting the victim system's IP address, and spawning a command shell for remote tasking. It uses cmd.exe as part of its persistence setup and command execution workflow. Pisloader communications have been noted for using Base32-encoded command-and-control responses, indicating an effort to obfuscate traffic. It has also been associated with DNS tunneling tradecraft, reflecting use of covert application-layer communications to exchange data and instructions. The available evidence supports characterization as a backdoor-oriented implant focused on maintaining access, basic host discovery, and remote command execution on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence4

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

2 techniques

T1112Modify RegistryEvidence1

DarkTortilla can use cmd.exe to add registry keys for persistence. HeartCrypt can use the reg add command via cmd.exe for Registry modification. Ryuk has used cmd.exe to create a Registry entry to establish persistence.

T1547.001Registry Run Keys / Startup FolderEvidence7

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence7

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Command and Control

4 techniques

T1071.004DNSEvidence2

ATT&CK Ⓡ does not have an explicit technique assigned for DNS Tunneling; instead, it identifies this technique as a sub-technique of Command and Control Over Application Layer Protocol, described as follows: “Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.”

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence1

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Includes a command to collect victim IP addresses.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor with a command to collect the victim's IP address.

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that establishes persistence through a Registry Run key.

mitre attack websiteNews

Oct 21, 2021

Data Encoding: Standard Encoding, Sub-technique T1132.001 - Enterprise | MITRE ATT&CK®

Malware whose command-and-control server responses are Base32-encoded.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Pisloader