MemFun
MemFun is a custom backdoor used in the long-running cyber espionage campaign tracked as CL-STA-1087, which has targeted military organizations in Southeast Asia since at least 2020. Reporting assesses the broader campaign with moderate confidence as China-aligned or China-nexus, although no specific threat group is publicly named. MemFun was deployed alongside the AppleChris backdoor and the Getpass credential harvester in operations focused on selective intelligence collection against military environments, including C4I-related systems, domain controllers, web servers, IT workstations, and executive assets.
MemFun is described as a modular, multi-stage payload that executes entirely in memory. Its infection chain includes an initial loader disguised as GoogleUpdate.exe, an in-memory downloader, and a final DLL payload retrieved from the command-and-control server at runtime. The malware uses multiple evasion and anti-forensic techniques, including timestomping, process hollowing into dllhost.exe, reflective DLL loading, memory zeroing, anti-debugging, token impersonation, and in-memory execution to reduce disk artifacts and hinder analysis. It also used a dead drop resolver via Pastebin to dynamically resolve command-and-control infrastructure, and reporting states that AppleChris and MemFun used custom HTTP verbs for C2 communications.
Additional technical details reported for MemFun include session-specific Blowfish encryption for payload retrieval, with one description noting a downloader request pattern using the /DL1 resource, headers such as "Get: 0" and "User-Agent: MyIE," and a 24-byte Blowfish key sent in the Cookie header to decrypt the final payload. High-confidence indicators directly mentioned in the content include the loader name GoogleUpdate.exe, process hollowing into dllhost.exe, and use of Pastebin-based dead drop resolution as part of the CL-STA-1087 toolset.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They deployed two backdoors, AppleChris and MemFun, both using custom HTTP verbs and a dead drop resolver (DDR) via Pastebin to dynamically reach C2 servers.
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques
Execution
They used Windows Management Instrumentation (WMI) and native Windows .NET commands to spread malware to domain controllers, web servers, IT workstations, and executive systems
The cybersecurity vendor said it detected the intrusion set after identifying suspicious PowerShell execution, allowing the script to enter into a sleep state for six hours and then create reverse shells to a threat actor-controlled command-and-control (C2) server.
Persistence
2 techniques
Persistence
Privilege Escalation
5 techniques
Privilege Escalation
MemFun is launched by means of a multi-stage chain: an initial loader injects shellcode responsible for launching an in-memory downloader... Subsequently, it injects the main payload into the memory of a suspended process associated with "dllhost.exe" using a technique referred to as process hollowing.
MemFun used timestomping, process hollowing into dllhost.exe, and reflective DLL loading to stay hidden
Stealth
10 techniques
Stealth
MemFun is launched by means of a multi-stage chain: an initial loader injects shellcode responsible for launching an in-memory downloader... Subsequently, it injects the main payload into the memory of a suspended process associated with "dllhost.exe" using a technique referred to as process hollowing.
MemFun used timestomping, process hollowing into dllhost.exe, and reflective DLL loading to stay hidden
It runs entirely in memory, using process hollowing, reflective DLL loading, and anti-forensic techniques like timestomping and memory zeroing.
MemFun used timestomping, process hollowing into dllhost.exe, and reflective DLL loading to stay hidden
The downloader performs token impersonation to steal and impersonate logged-on user credentials, allowing it to inherit user proxy settings and bypass network restrictions
It launches dllhost.exe in a suspended state and decrypts an embedded shellcode payload using the XOR key 0x25.
To bypass automated security systems, some of the malware variants employ sandbox evasion tactics at runtime. These variants trigger delayed execution through sleep timers of 30 seconds (EXE) and 120 seconds (DLL), effectively outlasting the typical monitoring windows of automated sandboxes.
performed DLL hijacking by placing malicious DLL files inside the system32 directory, registering them through legitimate Windows services to blend in.
Discovery
2 techniques
Discovery
To bypass automated security systems, some of the malware variants employ sandbox evasion tactics at runtime. These variants trigger delayed execution through sleep timers of 30 seconds (EXE) and 120 seconds (DLL), effectively outlasting the typical monitoring windows of automated sandboxes.
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
Command and Control
4 techniques
Command and Control
running delayed execution scripts that connected back to multiple command-and-control (C2) servers.
They deployed two backdoors, AppleChris and MemFun, both using custom HTTP verbs and a dead drop resolver (DDR) via Pastebin to dynamically reach C2 servers.
IOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom in-memory backdoor designed for stealth. It is delivered via a file disguised as GoogleUpdate.exe, then uses an in-memory downloader to fetch a DLL payload from C2. It employs timestomping, process hollowing into dllhost.exe, reflective DLL loading, and session-specific Blowfish keys for encrypted payload exchange.
Custom modular multi-stage backdoor executed entirely in memory. It uses a loader, in-memory downloader, and final DLL payload, and employs timestomping, process hollowing into dllhost.exe, reflective DLL loading, and session-specific Blowfish encryption for payload delivery.
A modular, multi-stage backdoor consisting of a GoogleUpdate.exe loader, an in-memory downloader, and a final DLL payload from the C2 server. It runs entirely in memory and uses process hollowing, reflective DLL loading, timestomping, memory zeroing, and Blowfish-encrypted C2 communications for stealthy operations.
A novel backdoor used in the CL-STA-1087 cyberespionage campaign against Southeast Asian military organizations. It uses dead-drop resolvers via legitimate services such as Pastebin and Dropbox, includes protected C2 retrieval through encryption, and uses evasion methods including delayed execution and timestomping.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.