Loading malware…
SADBRIDGE is a custom Windows malware loader observed by Elastic Security Labs in intrusion set REF3864 targeting Chinese-speaking users via trojanized installers masquerading as legitimate software such as Telegram and Opera GX. It is delivered through ZIP archives containing trojanized MSI installers that abuse DLL side-loading, including use of x64dbg.exe to load a malicious x64bridge.dll, followed by execution of a renamed MonitoringHost.exe as DevQueryBroker.exe to side-load HealthServiceRuntime.dll. SADBRIDGE deploys a Golang-based reimplementation of the QUASAR RAT known as GOSAR.
SADBRIDGE stores an encrypted configuration at C:\Users\Public\Documents<hostname_hash>\edbtmp.log using hidden, system, and read-only attributes. Configuration obfuscation uses subtraction by 0x1, and encrypted stage files with .log extensions use XOR plus LZNT1 decompression. The loader establishes persistence through Windows service creation and registry modifications, silently elevates privileges via a UAC bypass abusing the ICMLuaUtil COM interface, and can also use Windows Task Scheduler together with the IElevatedFactorySever COM object to execute payloads with SYSTEM privileges.
For defense evasion and execution, SADBRIDGE uses long Sleep calls for sandbox evasion, patches AmsiScanBuffer and AmsiOpenSession in amsi.dll and EtwEventWrite in ntdll.dll to disable AMSI and ETW visibility, and employs multiple injection techniques including PoolParty Variant 7, APC queues, and token manipulation. Elastic reported that the final GOSAR payload is injected into svchost.exe for logged-in sessions and into dllhost.exe for service sessions or sessions without a logged-in user. Multiple reports cited in the content note that SADBRIDGE is the only other malware observed using PoolParty Variant 7, specifically shellcode injection into explorer.exe, creating a notable overlap with separate fake-installer campaigns delivering ValleyRat/Winos 4.0.
The associated GOSAR payload is a multi-functional RAT for Windows and Linux that supports system information collection, command execution, screenshots, keylogging, clipboard logging, plugin execution, and hidden VNC. It communicates over TCP with TLS, retains compatibility with the original QUASAR protocol, and keeps the default listening port 1080. Additional observed behavior includes creating an inbound firewall rule for ports 51756-51776 under a Chinese-language name translated as Distributed Transaction Coordinator (LAN), modifying the hosts file with 127.0.0.1 micrornetworks.com, and running an HTTP listener that responds to GET /security.js with callback();.
Researchers assessed both operators and intended victims are likely Chinese-speaking based on Chinese-language logging, checks for Chinese AV artifacts such as 360tray.exe, and Chinese firewall-rule naming. Extracted configurations indicate related SADBRIDGE operations have likely been active since at least December 2023. Observables directly associated with this activity include landing-page domains opera-x[.]net and teledown-cn[.]com; GOSAR C2 domains ferp.googledns[.]io, hk-dns.secssl[.]com, hk-dns.winsiked[.]com, hk-dns.wkossclsaleklddeff[.]is, and hk-dns.wkossclsaleklddeff[.]io; and SHA-256 hashes 15af8c34e25268b79022d3434aa4b823ad9d34f3efc6a8124ecf0276700ecc39 (NetFxRepairTools.msi), accd651f58dd3f7eaaa06df051e4c09d2edac67bb046a2dcb262aa6db4291de7 (x64bridge.dll), and 7964a9f1732911e9e9b9e05cd7e997b0e4e2e14709490a1b657673011bc54210 (GOSAR).
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
SADBRIDGE integrates a public UAC bypass technique using the IElevatedFactorySever COM object to indirectly create the scheduled task. This task is configured to run DevQueryBroker.exe on a daily basis with SYSTEM level privileges.
SADBRIDGE employs PoolParty, APC queues, and token manipulation techniques for process injection.
the encrypted shellcode ... is decrypted ... and APC injection is used to queue the shellcode for execution in the newly created process’s thread.
If a session ID is available, the code attempts to duplicate the user token for that session and elevate the duplicated token's integrity level to S-1-16-12288 (System integrity).
The SADBRIDGE configuration is encrypted using a simple subtraction of 0x1 on each byte of the configuration string. The encrypted stages are all appended with a .log extension, and decrypted during runtime using XOR and the LZNT1 decompression algorithm.
These organized campaigns target victims by masquerading as legitimate software such as web browsers or social media messaging services.
SADBRIDGE employs PoolParty, APC queues, and token manipulation techniques for process injection.
the encrypted shellcode ... is decrypted ... and APC injection is used to queue the shellcode for execution in the newly created process’s thread.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom malware loader mentioned as prior context; it uses PoolParty Variant 7 and is designed to deploy GOSAR.
Malware family noted for also using the rare PoolParty Variant 7 process injection technique; mentioned as similar to ValleyRat, suggesting shared tooling or evolution within the same ecosystem.
Custom Windows malware loader delivered via trojanized MSI installers. It uses DLL side-loading, shellcode decryption, process injection, AMSI/ETW patching, UAC bypass via ICMLuaUtil, Task Scheduler abuse, and service/registry persistence to ultimately inject and launch GOSAR.
Referenced as another malware family observed using the uncommon PoolParty Variant 7 process-injection technique; used for comparative attribution to the fake installer activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.