Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The .NET assembly loaded by the PowerShell stager is what IBM X-Force researchers call 'VMDetectLoader'. This modular loader is responsible for persistence options, environment checks, and injecting the next stage.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
it builds a PowerShell command with a Base64-encoded payload and fires it off using WMI. It launches a hidden PowerShell process and runs the decoded payload in memory with Invoke-Expression.
the loader employs a classic, well-documented process injection technique known as RunPE , or process hollowing
It launches the legitimate .NET Framework utility CasPol.exe in a suspended state, removes its original code from memory, and replaces it with the decoded payload.
At first glance, the file is unreadable: It's packed with non-ASCII characters that break static analysis and mess with signature-based detection.
No file hits disk, so basic file-based AV doesn't see it. Standard fileless execution.
the loader employs a classic, well-documented process injection technique known as RunPE , or process hollowing
It launches the legitimate .NET Framework utility CasPol.exe in a suspended state, removes its original code from memory, and replaces it with the decoded payload.
its sole purpose is to decrypt, decompress, and execute the final payload entirely within memory.
CasPol.exe is a legitimate .NET Framework tool (Code Access Security Policy Tool), which makes it the perfect cover. Security tools see it as a trusted Microsoft utility.
VM Detection Enabled : A standard sandbox evasion check. If the loader detects that it's running in a virtual machine, it terminates.
Once extracted, the script Base64-decodes the payload and loads it directly into memory using .NET Reflection.
VM Detection Enabled : A standard sandbox evasion check. If the loader detects that it's running in a virtual machine, it terminates.
Instead of fetching an executable from some disposable domain, it downloads a PNG image from archive.org... The loader's main job is to fetch the next stage payload.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.