Loading malware…
HelloExecutor is a Windows backdoor used in the HelloNet intrusion set targeting Russian organizations. It has been observed in campaigns abusing the ViPNet update mechanism, where attackers use DLL sideloading through a trusted ViPNet component to establish persistence and load additional malware modules. Within this toolchain, HelloExecutor is delivered as a follow-on module by HelloProxy and operates from an already compromised host.
Its primary functions are remote command execution and host and network reconnaissance. Operators used it to run shell commands, enumerate users and groups, inspect network configuration, and collect information about installed ViPNet software and the surrounding environment. Reporting also indicates it was used alongside SSH tunneling to support attacker access to compromised infrastructure. The malware has been associated with espionage activity affecting Russian government, energy, transport, education, logistics, industrial, electronics, instrumentation, IT, and software-development organizations.
HelloExecutor has been described as part of a broader malware cluster that also includes HelloInjector, HelloProxy, HelloCleaner, and the Rust-based HelloBackdoor. Attribution of the overall campaign to a Chinese-speaking threat actor has been assessed only with low confidence.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The deployed malware, HelloProxy, contacts a command-and-control server for additional modules like HelloExecutor (a backdoor) and HelloBackdoor (a Rust-based implant).
26 distinct techniques documented for this family, organized by ATT&CK tactic.
HelloExecutor : backdoor permettant l’exécution de commandes ... HelloBackdoor ... supporte l’exécution de commandes
HelloExecutor then runs shell commands for reconnaissance.
Detected TTPs: T1059 / T1218 — Proxy execution via AutoIt – “cmd” /c \$windir\autoit3.exe \$windir\data.dat
Detected TTPs: T1569.002 — System Services: Service Execution – “cmd” /c sc start UrBackupClientBackend
Detected TTPs: T1112 — Modify Registry – reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32$selfname.dll
Detected TTPs: T1543.003 — Create or Modify System Process: Windows Service – sc stop AppMgmt – sc delete AppMgmt – sc create AppMgmt binpath= “system32\svchost.exe -k netsvcs”
Он ищет процесс, имя которого содержит строку svchost, а командная строка — строку netsvcs. Если такой процесс найден, загрузчик внедряет себя в целевой процесс с помощью функций NtWriteVirtualMemory и NtCreateThreadEx.
Detected TTPs: T1543.003 — Create or Modify System Process: Windows Service – sc stop AppMgmt – sc delete AppMgmt – sc create AppMgmt binpath= “system32\svchost.exe -k netsvcs”
Detected TTPs: T1036 — Masquerading (service, description, and DLL masquerade as the legitimate Application Management)
Он ищет процесс, имя которого содержит строку svchost, а командная строка — строку netsvcs. Если такой процесс найден, загрузчик внедряет себя в целевой процесс с помощью функций NtWriteVirtualMemory и NtCreateThreadEx.
Detected TTPs: T1070.004 — Indicator Removal: File Deletion – “cmd” /c del $windir\amgmt.dll – “cmd” /c del $public\libraries\APN000B.txt
Detected TTPs: T1059 / T1218 — Proxy execution via AutoIt – “cmd” /c \$windir\autoit3.exe \$windir\data.dat
Detected TTPs: T1112 — Modify Registry – reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32$selfname.dll
Detected TTPs: T1007 — System Service Discovery – “cmd” /c sc query UrBackupClientBackend
...с его помощью атакующие собирали информацию о пользователях, группах, сетевых настройках...
Detected TTPs: T1018 — Remote System Discovery – “cmd” /c ping mail.ru -n 2
HelloExecutor выполняет команды и используется для разведки, и с его помощью атакующие собирали информацию о пользователях...
HelloExecutor, a backdoor that can execute commands and conduct network reconnaissance on the host
Detected TTPs: T1049 — System Network Connections Discovery – “cmd” /c netstat -ano
Detected TTPs: T1057 — Process Discovery – “cmd” /c tasklist
...с его помощью атакующие собирали информацию о пользователях, группах...
HelloExecutor : backdoor permettant l’exécution de commandes et la reconnaissance réseau
Detected TTPs: T1083 — File and Directory Discovery – “cmd” /c dir temp*.tmp – “cmd” /c dir $temp\*.tmp – “cmd” /c dir amgmt*
Исполнялись следующие шелл-команды: ... net user /do net group /do ...
...с его помощью атакующие собирали информацию о пользователях, группах, сетевых настройках и установленном ПО ViPNet;
In addition, the threat actors have been found to launch an SSH reverse tunnel...
Detected TTPs: T1005 — Data from Local System – “cmd” /c type $temp\TS_E9E3.tmp – “cmd” /c type $temp\Acr6F3D.tmp
Detected TTPs: T1074.001 — Local Data Staging – “cmd” /c copy appdata\infotecs\*\APN000B.txt $public\libraries\
The deployed malware, HelloProxy, contacts a command-and-control server for additional modules like HelloExecutor (a backdoor) and HelloBackdoor (a Rust-based implant).
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.