Malware

Starloader

StarLoader is a Windows malware loader associated with staged execution of shellcode. It decrypts and executes shellcode from an external payload file and has been observed masquerading as legitimate software update packages, including software commonly associated with Adobe Acrobat Reader and Intel, to reduce suspicion and improve execution success. Its observed tradecraft centers on payload decryption and execution rather than standalone espionage or destructive functionality, making it most accurately characterized as a loader used to launch subsequent malicious code. High-confidence reporting supports defense-evasion through masquerading and post-compromise payload staging on Windows systems, but broader attribution, targeting, and downstream payload objectives are not established from the available information.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

4 techniques

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.003Rename Legitimate UtilitiesEvidence1

Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.

T1036.005Match Legitimate Resource Name or LocationEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence8

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Loader malware that decrypts and executes shellcode from a file.

mitre attack websiteNews

Oct 21, 2021

Masquerading: Match Legitimate Name or Location, Sub-technique T1036.005 - Enterprise | MITRE ATT&CK®

Loader malware that disguises itself as legitimate software update packages.

mitre attack websiteNews

Jan 1, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Loader malware that decrypts and executes shellcode from a file.

mitre attackNews

Jan 25, 2026

Masquerading: Match Legitimate Name or Location, Sub-technique T1036.005 - Enterprise | MITRE ATT&CK®

Loader that masquerades as legitimate software update packages to trick users into execution.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Starloader