Loading malware…
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Using CreateProcessA, it spawns a new process in a suspended or controlled state... Additional logic suggests it may inject or manipulate the payload within the created process.
The Base64-encoded string was decoded to 0/jWzXCALY/d/ved.eetsap//:sptth , which reveals a reversed URL... the malware uses Base64 encoding combined with string reversal to conceal its command-and-control (C2) or payload hosting domain.
Using CreateProcessA, it spawns a new process in a suspended or controlled state... Additional logic suggests it may inject or manipulate the payload within the created process.
Once executed, the RAT establishes communication with a command-and-control (C2) server... the malware establishes a secure channel to receive instructions or exfiltrate data.
From there, the script loads ClassLibrary3.dll directly into memory and invokes the obfuscated method prFVI, which then loads ClassLibrary1.dll.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.