Malware

RDFSNIFFER

RDFSNIFFER is a Windows malware family documented as interacting extensively with victim systems through Win32 API functions. Observed behavior includes deletion of local files on compromised hosts, indicating a defense-evasion and cleanup capability that can be used to remove artifacts, operational data, or traces of activity. Available reporting supports its operation on Windows systems but does not provide sufficient high-confidence detail to classify it more specifically by malware family, nor to attribute it to a particular threat actor or confirm distinct delivery vectors from the supplied facts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence2

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Stealth

1 technique

T1070.004File DeletionEvidence8

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Credential Access

1 technique

T1056.004Credential API HookingEvidence1

Collection

1 technique

T1056.004Credential API HookingEvidence1

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that uses several Win32 APIs to interact with victim systems.

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Credential theft malware with local file deletion capability.

mitre attackNews

Jan 25, 2026

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Interacts with victim machine using Win32 APIs (details not specified).

mitre attackNews

Jan 25, 2026

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Interacts with the victim machine using multiple Win32 API functions (details not specified).

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RDFSNIFFER