Loading malware…
ReZer0 is a .NET malware loader used to deliver and execute follow-on payloads, including commodity remote access malware such as MassLogger, NanoCore, and Remcos. It has been associated with phishing-led intrusion activity attributed by some researchers to a cluster referred to as Vendetta, active since at least 2020 and assessed to target organizations for commercial or business intelligence collection. ReZer0 has appeared in campaigns using socially engineered lures themed as official notices from government, law-enforcement, health, and corporate entities.
ReZer0 stores an embedded payload and a configuration array within the loader and uses hard-coded instructions to determine which malicious functions to execute. Observed execution options include direct in-memory loading of a .NET payload, download-and-execute behavior for remotely hosted payloads, and process hollowing into legitimate Windows processes. The loader has also been observed copying itself for persistence and creating a scheduled task to relaunch at user logon.
The malware incorporates multiple anti-analysis and evasion features. Documented checks include anti-virtualization logic for common hypervisor artifacts, anti-sandbox checks for Sandboxie and suspicious usernames or execution paths, and sleep-based delays. Some reporting also attributes antivirus-bypass functionality to the family. In analyzed samples, the embedded payload is decrypted early in execution and placed into a static byte array before environmental checks complete, which has made the family notable in reverse-engineering research focused on extracting second-stage payloads without fully executing the loader.
ReZer0 targets Windows systems and functions primarily as a staging component in multi-step infection chains. Its design emphasizes flexible payload delivery, in-memory execution, persistence, and defense evasion rather than standalone end-goal effects.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The execution logic of ReZer0 is controlled by hard-coded built-in instructions. According to different instructions, different malicious functions are executed. Its design logic resembles the design method of backdoor programs.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The strings in the loader are obfuscated. The function named smethod_0 in Class5 requires an integer as input, after which it returns the deobfuscated string.
The compressed file in the email attachment contains the Trojan file, which is generally named after pdf.exe, Document.exe, etc.
[0]! = 4 Inject the plugin in the resource into the system process to execute
The technique to load the next stage is called process hollowing. The process is created with 4 as the value fo the dwCreationFlags variable. This means that the process is started in a suspended state.
After running, it decrypts and loads the subsequent virus module in memory.
This function checks for the presence of artifacts that are usually only present in virtual environments. As such, the function can be renamed to detectVirtualEnvironment.
If the username contains USER , SANDBOX , VIRUS , MALWARE , SCHMIDTI , or CURRENTUSER , the malware also assumes its in a sandbox environment. If the full path of the loader contains \VIRUS , SANDBOX , SAMPLE , or is equal to C:\file.exe , the malware also assumes its in an analysis environment.
This function checks for the presence of artifacts that are usually only present in virtual environments. As such, the function can be renamed to detectVirtualEnvironment.
If the username contains USER , SANDBOX , VIRUS , MALWARE , SCHMIDTI , or CURRENTUSER , the malware also assumes its in a sandbox environment. If the full path of the loader contains \VIRUS , SANDBOX , SAMPLE , or is equal to C:\file.exe , the malware also assumes its in an analysis environment.
The newly created web client is used to download a file to a temporary folder. The function’s first argument is the URL to download the file from, whereas the second argument is the file name of the file in the temporary folder. Once the download has been completed, the file is started.
174 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A .NET loader that stores an embedded payload in a private static byte array and configuration in a private static string array. It can launch payloads directly from memory or via process hollowing into processes such as MSBuild.exe, vbc.exe, RegSvcs.exe, or the loader's own process. It also supports scheduled-task persistence, optional remote payload download/execution, anti-virtualization, anti-sandbox checks, message-box display, and sleep-based evasion.
A backdoor-style malware under apparent active development that executes hard-coded instructions to load or inject plugins, register scheduled tasks, download and run files, evade analysis, bypass antivirus, and sleep. It also carries remote-control trojans in its resources.
A .NET loader used in a MassLogger execution chain. It decrypts an embedded next-stage payload at startup, performs anti-VM and anti-sandbox checks, can sleep to evade analysis, establish persistence via a scheduled task, optionally download and run an external payload, directly load a .NET assembly, or launch the next stage via process hollowing/RunPE-style injection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.