Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacker created a scheduled task named GoogleUpDate on remote machines using admin credentials. The task runs once with System account privileges right after it was created, executing the batch script located at C:\Users\<username>\Videos\1.bat.
schtasks /query /fo LIST /v | findstr “TaskName> Status> ‘Task To Run’> ‘Run As User’>” Lists all scheduled tasks in verbose mode
The attacker created a scheduled task named GoogleUpDate on remote machines using admin credentials. The task runs once with System account privileges right after it was created, executing the batch script located at C:\Users\<username>\Videos\1.bat.
The attacker created a scheduled task named GoogleUpDate on remote machines using admin credentials. The task runs once with System account privileges right after it was created, executing the batch script located at C:\Users\<username>\Videos\1.bat.
schtasks /query /fo LIST /v | findstr “TaskName> Status> ‘Task To Run’> ‘Run As User’>” Lists all scheduled tasks in verbose mode
ipconfig /all Displays detailed network configuration information.
WHOAMI /all Displays detailed information about the current user, including their security identifiers (SIDs), privileges, group memberships, and authentication details.
powershell Get-NetTCPConnection Retrieves information about TCP connections.
After establishing the connection, they searched the shared drives for confidential documents to exfiltrate. | wevtutil qe Security /f:text /c:5 /rd:true /q:”*[System[(EventID=4624)]] and *[EventData[Data[@Name=’LogonType’]=10]]” Retrieves the last 5 events from the Security event log
including command execution, file manipulation, screenshot capture, clipboard monitoring, keyboard and mouse simulation
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly identified modular backdoor used in a cyber espionage campaign against Central Asian government and related organizations. It is delivered through a lightweight loader that injects the backdoor into memory, checks internet connectivity, launches LurkProxy, communicates with C2 servers, gathers host information, encrypts collected data, and retrieves in-memory plugins for capabilities such as command execution, file manipulation, screenshot capture, clipboard monitoring, keylogging, credential dumping, browser password theft, network scanning, and remote access.
An obfuscated in-memory backdoor deployed via a loader. It collects system information, communicates with a hard-coded C2 server, and can load plugins directly into memory for command execution, file operations, clipboard collection/modification, screenshot capture, mouse movements, credential dumping, keylogging, browser password theft, email collection, and remote access.
A heavily obfuscated in-memory backdoor delivered via a customized loader that decrypts payloads using victim-specific machine data (including the C: drive serial number). It communicates with hard-coded C2 infrastructure, collects host information, and can download and inject plugins for command shell access, file management, screen/clipboard interaction, credential dumping, keylogging, browser password theft, email collection, network scanning, and remote access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.