Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In Operation FishMedley, the attackers used a ShadowPad version packed with ScatterBee.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Introducing ScatterBee loader in 2020 marked a significant technical leap, showcasing advanced obfuscation techniques that complicate malware analysis efforts.
The malware payloads are traditionally deployed to a host either encrypted within a DLL loader or embedded inside a separate file along with a DLL loader, which then decrypts and executes the embedded ShadowPad payload in memory using a custom decryption algorithm tailored to the malware version.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A packer/loader used here to wrap and deliver ShadowPad.
A loader introduced in 2020 that uses advanced obfuscation techniques to hinder malware analysis.
A bespoke packing mechanism used to obfuscate 32-bit and 64-bit ShadowPad payloads.
Bespoke packing/obfuscation mechanism used by RedHotel to protect/obfuscate ShadowPad payloads; also described as persisting via Run key and storing encrypted payload in the registry.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.