Loading malware…
HollowFrame is a previously undocumented Go-based Windows loader framework used in a multi-stage intrusion chain that also deployed the Rust-based Matryoshka backdoor family. It functions as a modular loader and persistence framework designed to stage and execute auxiliary components while reducing the visibility of later-stage behavior in earlier components. Observed tradecraft used DLL sideloading with a legitimate Python interpreter and a malicious Python-compatible DLL to transfer execution into the loader.
HollowFrame supports multiple stealth-oriented execution methods, including process ghosting, module stomping, manual PE mapping, shellcode execution, and thread creation through native APIs. It also includes anti-analysis logic intended to avoid execution in sandboxed or artificial environments by checking factors such as system uptime, installed memory, file population in the user profile, and cursor movement. The framework has been observed weakening endpoint protections before payload retrieval and establishing persistence through scheduled tasks, permanent WMI event subscriptions tied to logon activity, and Startup-folder deployment.
In the documented intrusion chain, HollowFrame was delivered through spearphishing that lured victims into opening a malicious Windows shortcut contained in an encrypted archive. Subsequent stages used script-based execution and privilege elevation to prepare the host, then staged a fake Python environment for sideloading. HollowFrame decrypted and launched additional payloads, including components that deployed Matryoshka variants. Those follow-on implants provided persistent remote command execution, reconnaissance, file transfer, and secondary payload delivery, including use of trusted processes and cloud-hosted dead-drop command channels to blend malicious traffic with legitimate activity.
Observed targeting involved a law firm, and the combined HollowFrame-Matryoshka chain is notable for its layered architecture, anti-analysis features, persistence options, and use of trusted binaries and services to complicate detection, attribution, and incident response. The threat actor associated with the activity remains unknown.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain that prompted the user for administrator rights.
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
A link routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, containing a shortcut file named Case Documents.lnk. Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
That code was HollowFrame, a modular loader offering several execution methods including process ghosting, module stomping and manual PE mapping
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
A link routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, containing a shortcut file named Case Documents.lnk. Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain
Running it launched a command chain that wrote Base64 content into %TEMP%\sgrfm.b64...
The archive it retrieved was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64.
That code was HollowFrame, a modular loader offering several execution methods including process ghosting, module stomping and manual PE mapping
Running it launched a command chain that wrote Base64 content into %TEMP%\sgrfm.b64 , created %TEMP%\sgrfm.cmd , used certutil.exe -decode...
while performing anti-analysis diagnosis to escape running inside sandboxed environments. This is decided based on installed memory, cursor movement, file count in the user profile, and system uptime.
Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular Go-based loader disguised inside a counterfeit Python runtime via DLL sideloading. It can use process ghosting, module stomping, and manual PE mapping, performs environment checks such as uptime, memory, and cursor movement, and supports persistence via scheduled tasks, WMI event subscriptions, and the Startup folder.
A recently undocumented Go-based modular loader and persistence framework launched via DLL side-loading using a legitimate Python binary and a rogue DLL. It downloads and deploys additional payloads, performs anti-analysis checks, establishes persistence via scheduled task, and supports follow-on compromise activity.
A persistence-capable Windows loader/backdoor used in a shortcut-initiated intrusion chain. It is delivered via obfuscated PowerShell and a staged fake-looking Python environment, using a rogue python311.dll to transfer execution into HollowFrame and establish persistent remote access.
A Go-based loader framework used in a multi-stage intrusion initiated via spear-phishing. It executes from an LNK-delivered chain, performs privilege escalation, disables Microsoft Defender protections, downloads additional payloads, uses DLL side-loading with a legitimate Python binary, applies anti-analysis checks, and establishes persistence via scheduled tasks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.