Malware

KilllSomeOne

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

It also takes several steps to ensure persistence, including the creation of a task that executes the side-loading executable that began the deployment: schtasks /create /sc minute /mo 5 /tn LKUFORYOU_1 /tr

T1059.003Windows Command ShellEvidence1

The final payload is a DLL file... The DLL is a simple remote command shell, connecting back to a server with the IP address 160.20.147.254 on port 9999.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

Additionally, it creates a registry auto-run key that does the same thing: Software\Microsoft\Windows\CurrentVersion\Run\SafeGuard

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

Additionally, it creates a registry auto-run key that does the same thing: Software\Microsoft\Windows\CurrentVersion\Run\SafeGuard

Stealth

5 techniques

T1036MasqueradingEvidence1

The installer then closes the executable used in the initial stage of the attack, and starts a new instance of explorer.exe to side-load the dropped DLL component. This is an effort to conceal the execution...

T1070.004File DeletionEvidence1

The installer also looks for a running process with a name starting with “AAM,” then kills the process and deletes the file associated with it in C:\ProgramData and C:\Users\All Users.

T1140Deobfuscate/Decode Files or InformationEvidence1

That function loads and decrypts the final payload, stored in the file Groza_1.dat: The encryption is simple XOR algorithm...

T1564.001Hidden Files and DirectoriesEvidence1

The installer also assigns the files the “hidden” and “system” attributes to conceal them from users.

T1620Reflective Code LoadingEvidence1

The content of that file is a PE loader shellcode, which decrypts the final payload, loads into memory and executes it.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

...and also collects system information, including volume names and free disk space.

Collection

1 technique

T1074Data StagedEvidence1

It then copies files to the Recycle Bin on the drive in the subfolder ‘files,’ ... And lastly, it copies all the .dat files dropped... into the installation directories

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

The DLL is a simple remote command shell, connecting back to a server with the IP address 160.20.147.254 on port 9999.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

A new APT uses DLL side-loads to “KilllSomeOne” | SOPHOS

A DLL side-loading malware cluster used against NGOs and other organizations in Myanmar. It uses malicious DLL loaders and XOR-encrypted .dat payloads, installs persistence via scheduled tasks and Run keys, hides files, prepares removable drives for collection/exfiltration, and ultimately deploys a simple remote command shell that connects to a C2 server.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

KilllSomeOne

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

T1059.003Windows Command ShellEvidence1

The final payload is a DLL file... The DLL is a simple remote command shell, connecting back to a server with the IP address 160.20.147.254 on port 9999.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

Additionally, it creates a registry auto-run key that does the same thing: Software\Microsoft\Windows\CurrentVersion\Run\SafeGuard

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

Additionally, it creates a registry auto-run key that does the same thing: Software\Microsoft\Windows\CurrentVersion\Run\SafeGuard

Stealth

5 techniques

T1036MasqueradingEvidence1

T1070.004File DeletionEvidence1

The installer also looks for a running process with a name starting with “AAM,” then kills the process and deletes the file associated with it in C:\ProgramData and C:\Users\All Users.

T1140Deobfuscate/Decode Files or InformationEvidence1

That function loads and decrypts the final payload, stored in the file Groza_1.dat: The encryption is simple XOR algorithm...

T1564.001Hidden Files and DirectoriesEvidence1

The installer also assigns the files the “hidden” and “system” attributes to conceal them from users.

T1620Reflective Code LoadingEvidence1

The content of that file is a PE loader shellcode, which decrypts the final payload, loads into memory and executes it.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

...and also collects system information, including volume names and free disk space.

Collection

1 technique

T1074Data StagedEvidence1

It then copies files to the Recycle Bin on the drive in the subfolder ‘files,’ ... And lastly, it copies all the .dat files dropped... into the installation directories

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

The DLL is a simple remote command shell, connecting back to a server with the IP address 160.20.147.254 on port 9999.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

A new APT uses DLL side-loads to “KilllSomeOne” | SOPHOS

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.