Malware

Yellow Cockatoo

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

Gootkit relies on trojanized search engine optimization (SEO) social engineering techniques, similar to Yellow Cockatoo.

T1608.006SEO PoisoningEvidence2

These common business terms serve as keywords for the threat actors’ search optimization strategy, convincing Google’s web crawler that the intended content meets conditions for a high PageRank score.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

this campaign lays long-standing traps for victims using Google search redirection and the drive-by-download method.

Execution

4 techniques

T1059.001PowerShellEvidence2

The RAT, labeled (unknown), then goes on to install the decoy document and make malicious PowerShell calls.

T1059.003Windows Command ShellEvidence1

run specific cmd.exe commands

T1204User ExecutionEvidence1

The infection process relies on exploiting the user, not an application. The user simply executes a binary disguised as a PDF to infect the machine.

T1204.002Malicious FileEvidence2

Using LNK files for initial infection and persistence

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Finally, we’ll name the LNK file something innocuous and place it in the Windows Startup folder as our persistence mechanism.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Finally, we’ll name the LNK file something innocuous and place it in the Windows Startup folder as our persistence mechanism.

Stealth

2 techniques

T1036MasqueradingEvidence1

the executable disguised as a pdf document or a word document

T1620Reflective Code LoadingEvidence1

cmd.exe would be called to run a PowerShell one-liner that reflectively executes the malware.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

once SolarMarker is active, the threat actors can send commands and upload additional files to the infected system.

INDICATORS OF COMPROMISE

IOCs tracked for this family

68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

27 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

39 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

red canary blogNews

Apr 21, 2022

Intelligence Insights: April 2022

The return of Yellow Cockatoo in February fueled a strong rebound by this prevalent threat, as it soared back up the ranks near the volume we encountered in 2021.

forensicitguy blogNews

Feb 6, 2022

AgentTesla From RTF Exploitation to .NET Tradecraft | Tony Lambert

Mentioned as another malware family that uses similar staged .NET/payload-loading techniques.

red canary blogNews

Dec 4, 2020

How to detect Yellow Cockatoo remote access trojan

A .NET remote access trojan loaded in memory via PowerShell that collects host information, stores a host identifier in solarmarker.dat, communicates with C2, receives commands, downloads second-stage payloads, executes PowerShell scripts, and can inject payloads into msinfo32.exe using process hollowing.

cybereason blogNews

Aug 14, 2026

Remote access trojan/infostealer noted for using an LNK dropped in the Startup directory for persistence, invoking cmd.exe and a PowerShell one-liner to reflectively execute the malware.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching68

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Yellow Cockatoo

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

Gootkit relies on trojanized search engine optimization (SEO) social engineering techniques, similar to Yellow Cockatoo.

T1608.006SEO PoisoningEvidence2

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

this campaign lays long-standing traps for victims using Google search redirection and the drive-by-download method.

Execution

4 techniques

T1059.001PowerShellEvidence2

The RAT, labeled (unknown), then goes on to install the decoy document and make malicious PowerShell calls.

T1059.003Windows Command ShellEvidence1

run specific cmd.exe commands

T1204User ExecutionEvidence1

The infection process relies on exploiting the user, not an application. The user simply executes a binary disguised as a PDF to infect the machine.

T1204.002Malicious FileEvidence2

Using LNK files for initial infection and persistence

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Finally, we’ll name the LNK file something innocuous and place it in the Windows Startup folder as our persistence mechanism.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Finally, we’ll name the LNK file something innocuous and place it in the Windows Startup folder as our persistence mechanism.

Stealth

2 techniques

T1036MasqueradingEvidence1

the executable disguised as a pdf document or a word document

T1620Reflective Code LoadingEvidence1

cmd.exe would be called to run a PowerShell one-liner that reflectively executes the malware.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

once SolarMarker is active, the threat actors can send commands and upload additional files to the infected system.

INDICATORS OF COMPROMISE

IOCs tracked for this family

68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

27 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

39 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

red canary blogNews

Apr 21, 2022

Intelligence Insights: April 2022

The return of Yellow Cockatoo in February fueled a strong rebound by this prevalent threat, as it soared back up the ranks near the volume we encountered in 2021.

forensicitguy blogNews

Feb 6, 2022

AgentTesla From RTF Exploitation to .NET Tradecraft | Tony Lambert

Mentioned as another malware family that uses similar staged .NET/payload-loading techniques.

red canary blogNews

Dec 4, 2020

How to detect Yellow Cockatoo remote access trojan

cybereason blogNews

Aug 14, 2026

Remote access trojan/infostealer noted for using an LNK dropped in the Startup directory for persistence, invoking cmd.exe and a PowerShell one-liner to reflectively execute the malware.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching68

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.