Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
L’adresse du serveur C2 est encodée dans un fichier C:\ProgramData\desktop.ini ... Chaque ligne suivante contient un nombre d’espaces dont la valeur ASCII correspond à un caractère du domaine.
The malware was small, had a limited command set and disguised itself as legitimate Realtek software... RtkNGUI64.exe is the real name of Realtek's audio control panel... paths intended to resemble legitimate software.
exécute un binaire nommé RtkNGUI64.exe (nom légitime du panneau audio Realtek) via le chemin court Progra~1 ... Le domaine reconstitué est diagrtrack.com , typosquat de DiagTrack
Each victim gets an eight-character identifier... The same value becomes the name of a mutex, and a second copy waits a second for it before giving up.
La persistance survit aux redémarrages mais ne s’active qu’une fois par soir.
Its most unusual feature was its configuration: the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line of a Windows `desktop.ini` file. To a user, and to many automated inspection systems, the file would appear almost empty.
Beacon HTTP POST vers /version/check.php avec User-Agent Chrome 78 figé Corps : a=<id>&r=none
Every cycle then opens with an ICMP knock rather than an HTTP request. The backdoor resolves the domain, puts its eight-byte identifier in the payload of a 32-byte echo request, and waits a second for a reply.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.