Loading malware…
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Type 0x01 takes a raw command string as payload and executes it as NT AUTHORITY\SYSTEM on the target machine.
Because the driver intercepts inbound traffic at the WFP layer, any TCP service can potentially act as a carrier for backdoor commands.
the process spawned successfully and is visible in process hacker — but notably, its parent process is svchost.exe, not the user’s shell or any interactive application
attaches to it from kernel mode via KeStackAttachProcess, writes the command string into its address space, and spawns a remote thread via RtlCreateUserThread.
the process spawned successfully and is visible in process hacker — but notably, its parent process is svchost.exe, not the user’s shell or any interactive application
attaches to it from kernel mode via KeStackAttachProcess, writes the command string into its address space, and spawns a remote thread via RtlCreateUserThread.
0x03 – Shellcode execution
The driver converts the path to a Unicode string and calls ZwCreateFile with FILE_OVERWRITE_IF, meaning it will create the file if it does not exist or silently overwrite it if it does
the entire attack surface is a single .sys file that registers a Windows Filtering Platform (WFP) stream callout to intercept inbound TCP traffic.
Type 0x02 allows the operator to write arbitrary content to any path on the filesystem, bypassing all ACLs from kernel mode.
This dual-mode detection allows operators to blend malicious commands into legitimate-looking HTTP traffic, evading network detection that inspects only headers or URIs.
Commands arrive encrypted over the network, are authenticated with HMAC-SHA256, and executed entirely within the kernel.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.