Loading malware…
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Command Execution : Full shell access via ExecuteCommand and RunCommand
When a victim opens one of these files, the embedded HTML triggers an onerror handler on a broken image tag.
Host, token, and other settings are stored as encrypted byte arrays decrypted at runtime by a Dec() function.
Inside: six weaponized LNK files... The LNK files aren't shortcuts in any traditional sense. They're 1,664-byte HTML Application containers
The drop filenames are equally revealing. svchost.exe and msedgewebview.exe are chosen to blend into a Windows process listing.
A 22,528-byte .NET 4.8 assembly with the internal name RemoteMgmt.Agent.exe and a timestomped PE date of 2052
with process management including KillProcess and KillAllRunningProcesses
C2 Protocol : JSON over raw TCP on port 443. Not HTTPS -- raw TCP disguised on a common port.
C2 Protocol : JSON over raw TCP on port 443. Not HTTPS -- raw TCP disguised on a common port.
Each DLL is a WININET-based HTTP downloader. When RunPayload is called, it fetches a URL hardcoded at offset 0x142F8 and drops the downloaded file
This is a custom-built remote access trojan... The capabilities extracted from string and code analysis: Command Execution
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.