Loading malware…
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Delivery Spear phishing (fake purchase orders) ... MITRE ATT&CK TTPs ID Technique Implementation T1566.001 Spear Phishing Attachment .js file disguised as business document
Stage 2: Multi-Layer PowerShell Decryptor ... The embedded PowerShell payload (980KB) implements a five-layer decryption pipeline ... Stage 3: Reflective .NET Assembly Loader
Stage 1: Obfuscated JavaScript Dropper ... The dropper runs via Windows Script Host (WScript.exe) and hands off to an embedded PowerShell payload.
Persistence Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\GLOZVJ
Technique: Process hollowing — creates a suspended aspnet_compiler.exe process, unmaps its memory, maps the Stage 5 payload, then resumes execution
Persistence Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\GLOZVJ
The infection chain spans five stages: an obfuscated 1.3MB JS dropper → multi-layer XOR-decrypted PowerShell → reflective .NET assembly loader → process-hollowing injector → final AgentTesla payload.
Stage 2: Multi-Layer PowerShell Decryptor ... Layer 2: Custom rotational XOR cipher ... Layer 3: Second XOR pass with derived key
A string table containing 166 encoded entries is decoded at runtime using custom Base64/XOR encoding ... MITRE ATT&CK TTPs ... T1027.010 Command Obfuscation Base64 + XOR encoding
Technique: Process hollowing — creates a suspended aspnet_compiler.exe process, unmaps its memory, maps the Stage 5 payload, then resumes execution
Stage 2: Multi-Layer PowerShell Decryptor ... implements a five-stage decryption pipeline
Stage 3: Reflective .NET Assembly Loader ... Loads a .NET assembly from a byte array via reflection and invokes a specified method ... [System.Reflection.Assembly]::Load($data)
Keylogger WH_KEYBOARD_LL hook captures all keystrokes
Discord (token scraping via regex [\w-]{24}\.[\w-]{6}\.[\w-]{27} )
MITRE ATT&CK TTPs ... T1552.001 Credentials in Files FTP/email/VPN config file parsing
Windows Credential Manager vaults (all 8 vault GUIDs), IE/Edge credential vault
Credential Harvesting Targets Browsers (40+) ... AES Encryption (Browser credential decryption) BCrypt AES-GCM for Chromium v80+ ... DPAPI ... Firefox key4.db / key3.db
Public IP Discovery Makes HTTP request to external IP-check service (PublicIpAddressGrab)
Function Test-ProcessAbsence : Checks if Aspnet_compiler is running (persistence guard)
Included in every exfil email header ... victim hostname, IP, username, OS version
Keylogger WH_KEYBOARD_LL hook captures all keystrokes
Screenshot Capture Uses the CopyFromScreen GDI method at configurable intervals, saving as JPEG with timestamped filenames.
Clipboard SetClipboardViewer hook Sends clipboard content to C2
Protocol: SMTP (port 587, STARTTLS) ... mail.cottondreams.org
MITRE ATT&CK TTPs ... T1020 Automated Exfiltration SMTP exfil at configurable intervals
Protocol: SMTP (port 587, STARTTLS) ... Exfil: SMTP → kc@cottondreams.org via mail.cottondreams.org:587
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.