Albaniiutas

Albaniiutas is a Windows malware family closely related to Tmanger and assessed to have been used in espionage activity associated with TA428. It has been observed in lures targeting Mongolian political entities, including decoy content themed around members of Mongolia’s Citizens’ Representative Hural, indicating a focus on government or politically relevant organizations in East Asia.

Albaniiutas is modular and mirrors the role separation seen in Tmanger, with setup, loader, and client components. Infection has been observed beginning from a RAR archive containing an executable disguised as an XLSX document. When launched, the initial executable opens a decoy document and drops additional components. Execution flow depends on privilege level. In administrator contexts, the malware decrypts and installs components into system locations, uses a legitimate Microsoft Visual J# utility for DLL sideloading, and establishes persistence by registering a malicious DLL as a service. In non-administrator contexts, it writes components into user-accessible locations, establishes persistence through a Run key, then continues execution through the same sideloading chain. The malware also modifies embedded paths to match the local environment and timestomps dropped files to reduce visibility.

Albaniiutas uses multiple cryptographic routines during staging and runtime, including RC4 and AES-256, to decrypt configuration data and embedded payloads. Its loader ultimately decrypts and launches ClientX.dll, which functions as the primary remote access trojan component. The client retrieves updated command-and-control information from attacker-controlled web content, collects host information, and communicates with its controller using encrypted traffic. Supported operator commands include shell execution through cmd.exe, file upload, file download, and idle control behavior.

Code and design similarities strongly suggest shared development lineage with Tmanger and related families such as Smanager and PhantomNet. Reported overlaps include component structure, cryptographic material, export naming conventions, and plugin-loading logic. Albaniiutas is therefore best understood as part of an evolving malware lineage used in targeted intrusions linked to China-aligned espionage activity, particularly against Mongolian and other East Asian targets.