Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
As in the latter half of 2013, threat actors continued to exploit a bug in Windows Common Controls (CVE-2012-0158) and addressed by Microsoft Security Bulletin MS12-027. The PLEAD campaign against Taiwan ministries, in particular, was such an attack... ESILE variants exploited the same bug that Taidoor malware did, CVE-2012-0158. Note that Microsoft has patched this vulnerability in 2012.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The most notable behavioral trick is the PowerShell command executed during installation: Disable-NetAdapter -Name * -Confirm:$false
MITRE ATT&CK Mapping Technique ID T1129 Execution Shared Modules — Dynamic library loading
The DLL in turn extracts and loads into memory a payload hidden using steganography — a Farfli backdoor modification — and injects it into a process.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Victim runs fake AI installer Execution PowerShell T1059.001 Disable-NetAdapter command Defense Evasion Masquerading T1036.005 "openclawAI" branding Defense Evasion Impair Defenses: Disable Network T1562.004 Kills all network adapters Persistence (Unknown) — Randomized install path suggests persistence mechanism Privilege Escalation Access Token Manipulation T1134 AdjustTokenPrivileges in imports
MITRE ATT&CK Mapping Technique ID T1027 Defense Evasion Obfuscated Files — Unknown PE section names
The malware is protected with ASPack/HidePE anti-analysis packing... MITRE ATT&CK Mapping Technique ID T1027.002 Defense Evasion Software Packing — ASPack/HidePE protector
The DLL in turn extracts and loads into memory a payload hidden using steganography — a Farfli backdoor modification.
A 657840-byte PE32 executable masquerading as Microsoft's wininet.dll (Internet Extensions for Win32)... The binary carries fraudulent Microsoft version information designed to evade cursory inspection.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Victim runs fake AI installer Execution PowerShell T1059.001 Disable-NetAdapter command Defense Evasion Masquerading T1036.005 "openclawAI" branding
The DLL in turn extracts and loads into memory a payload hidden using steganography — a Farfli backdoor modification — and injects it into a process.
Deletes original executable and intermediate dropper after installation (T1070)
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Victim runs fake AI installer Execution PowerShell T1059.001 Disable-NetAdapter command Defense Evasion Masquerading T1036.005 "openclawAI" branding Defense Evasion Impair Defenses: Disable Network T1562.004 Kills all network adapters Persistence (Unknown) — Randomized install path suggests persistence mechanism Privilege Escalation Access Token Manipulation T1134 AdjustTokenPrivileges in imports
MITRE ATT&CK Mapping Technique ID T1202 Defense Evasion Indirect Command Execution — cmd.exe / rundll32
Checks available physical memory for sandbox detection... Detects virtual disk environments... Queries keyboard layout and locale for victim targeting/VM detection
Behavioral Analysis Execution Behaviors (CAPE Sandbox) Anti-Analysis: Checks available physical memory (< threshold → abort, T1082) Queries keyboard layout and Windows locale via registry... to detect VMs
Reconnaissance / Collection: Enumerates all running processes (T1057)
Collects system environment variables (USERNAME, COMPUTERNAME, PATH, etc.)... Records keyboard layout and locale (T1082)
Checks available physical memory for sandbox detection... Detects virtual disk environments... Queries keyboard layout and locale for victim targeting/VM detection
Communicates with operator C2 on TCP/6658 using Gh0stRAT's ZLIB-compressed binary protocol... Multiple User-Agent strings used across HTTP requests (T1071)
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Victim runs fake AI installer Execution PowerShell T1059.001 Disable-NetAdapter command Defense Evasion Masquerading T1036.005 "openclawAI" branding Defense Evasion Impair Defenses: Disable Network T1562.004 Kills all network adapters Persistence (Unknown) — Randomized install path suggests persistence mechanism Privilege Escalation Access Token Manipulation T1134 AdjustTokenPrivileges in imports Command and Control Application Layer Protocol T1071.001 HTTP/HTTPS to Alibaba Cloud C2
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Victim runs fake AI installer Execution PowerShell T1059.001 Disable-NetAdapter command Defense Evasion Masquerading T1036.005 "openclawAI" branding Defense Evasion Impair Defenses: Disable Network T1562.004 Kills all network adapters
96 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a Gh0st-family RAT whose builder uses the same default placeholder config strings observed in this campaign.
A modified Farfli backdoor delivered through an Inno Setup installer using DLL sideloading and steganography. The payload is extracted in memory and injected into a process for stealthy persistence and remote control.
Referenced as other malware that used the same template-modification targeted attack technique as ESILE.
Referenced as the malware lineage or codebase on which FlowCloud is based.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.