Malware

Proxy Tool

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence2

This is a backdoor listener that is designed as a service DLL... Implants in this malware family are typically loaded via a dropper installed as a service...

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence2

This is a backdoor listener that is designed as a service DLL... Implants in this malware family are typically loaded via a dropper installed as a service...

Discovery

3 techniques

T1057Process DiscoveryEvidence1

This proxy tool has basic backdoor functionality, including the ability to ... perform process listings

T1082System Information DiscoveryEvidence3

This proxy tool has basic backdoor functionality, including the ability to fingerprint the victim machine...

T1083File and Directory DiscoveryEvidence2

This proxy tool has basic backdoor functionality, including the ability to ... perform directory listings

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

The SMB worm... connects to a command and control (C2) infrastructure with servers located in Thailand, Poland, Italy, Bolivia, Singapore and the United States... It connects home every five minutes to send log data back to command and control (C2) infrastructure.

T1090ProxyEvidence3

Proxy Tool: Implants in this malware family are typically loaded via a dropper installed as a service, then configured to listen on TCP port 443.

T1105Ingress Tool TransferEvidence1

This is a backdoor listener that is designed as a service DLL. It includes functionality such as file transfer...

T1219Remote Access ToolsEvidence1

This is a backdoor listener that is designed as a service DLL. It includes functionality such as file transfer, system survey, process manipulation... The listener can also perform arbitrary code execution and execute commands on the command line.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

us cert gov legacyNews

Dec 19, 2014

Targeted Destructive Malware | CISA

A proxy-capable implant/backdoor typically installed as a service and listening on TCP 443, with capabilities to fingerprint victims, run commands, list directories/processes, and transfer files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Proxy Tool

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence2

This is a backdoor listener that is designed as a service DLL... Implants in this malware family are typically loaded via a dropper installed as a service...

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence2

This is a backdoor listener that is designed as a service DLL... Implants in this malware family are typically loaded via a dropper installed as a service...

Discovery

3 techniques

T1057Process DiscoveryEvidence1

This proxy tool has basic backdoor functionality, including the ability to ... perform process listings

T1082System Information DiscoveryEvidence3

This proxy tool has basic backdoor functionality, including the ability to fingerprint the victim machine...

T1083File and Directory DiscoveryEvidence2

This proxy tool has basic backdoor functionality, including the ability to ... perform directory listings

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

T1090ProxyEvidence3

Proxy Tool: Implants in this malware family are typically loaded via a dropper installed as a service, then configured to listen on TCP port 443.

T1105Ingress Tool TransferEvidence1

This is a backdoor listener that is designed as a service DLL. It includes functionality such as file transfer...

T1219Remote Access ToolsEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

us cert gov legacyNews

Dec 19, 2014

Targeted Destructive Malware | CISA

A proxy-capable implant/backdoor typically installed as a service and listening on TCP 443, with capabilities to fingerprint victims, run commands, list directories/processes, and transfer files.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.