Malware

MechaFlounder

MechaFlounder is a Windows malware family used for command-and-control over HTTP. It profiles compromised hosts by identifying the current username and hostname, and it transmits that victim-identifying information to its command-and-control infrastructure, including embedding the account name and hostname in request data. Its network communications use Base16-encoded strings, indicating a simple obfuscation layer for C2 traffic. MechaFlounder also supports remote command execution on infected systems, making it suitable for post-compromise control and operator tasking. The malware has been observed masquerading as a legitimate Windows process name to reduce suspicion and blend into the host environment. High-confidence reporting supports reconnaissance of host identity, command execution, HTTP-based C2, exfiltration of basic host metadata over the C2 channel, and defense-evasion through masquerading.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1059.006PythonEvidence1

Stealth

2 techniques

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.005Match Legitimate Resource Name or LocationEvidence2

Akira has used legitimate names and locations for files to evade defenses.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence6

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

T1082System Information DiscoveryEvidence1

Multiple malware families and threat groups are described as collecting the victim username or enumerating logged-on users (e.g., “can collect the username from the victim’s machine”, “enumerates the current user during the initial infection”, “enumerates logged-on users”).

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

ADVSTORESHELL exfiltrates data over the same channel used for C2.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that identifies the username and hostname on a compromised host.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Identifies the username and hostname on a compromised host.

mitre attack websiteNews

Oct 21, 2021

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®

Malware that sends compromised user account and hostname information to C2.

mitre attack websiteNews

Oct 21, 2021

Masquerading: Match Legitimate Name or Location, Sub-technique T1036.005 - Enterprise | MITRE ATT&CK®

Malware downloaded under the name of a legitimate Windows process to evade detection.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

MechaFlounder