Malware

Snifula

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

Spread through IE browser exploits ... It appeared to have been installed surreptitiously via a remote exploit ... hosted web sites ... host this exploit code ... JavaScript code using XMLHTTP and ADODB functions to download and run an EXE file

Execution

3 techniques

T1059.003Windows Command ShellEvidence1

The file [8 decimal digits from GetTickCount()].bat ... Batch file to delete files after installation ... It removes the installation file and itself.

T1559Inter-Process CommunicationEvidence1

At this point in time, a communication pipe is established on the system. The pipe is part of the Inter Process Communication schema of the malware and used to execute commands.

T1574.009Path Interception by Unquoted PathEvidence1

The file is registered in HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\ ... mmcpapir : c:\windows\system32\ctfmreg.dll

Persistence

2 techniques

T1112Modify RegistryEvidence1

The following Registry keys are set up in HKEY_CURRENT_USER\Software\AppDataLow\{dd2706e2-58d9-ec64-3673-ca57d81d8ca1 }

T1547.001Registry Run Keys / Startup FolderEvidence1

save and make it autostart via HKCU\Software\\Microsoft\\Windows\\CurrentVersion\\Run

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

inject_decrypted_resource_into_browser(HRSRC32, 0x10) ... inject_decrypted_resource_into_browser(HRSRC64, 0x18)

T1547.001Registry Run Keys / Startup FolderEvidence1

save and make it autostart via HKCU\Software\\Microsoft\\Windows\\CurrentVersion\\Run

Stealth

4 techniques

T1055Process InjectionEvidence1

inject_decrypted_resource_into_browser(HRSRC32, 0x10) ... inject_decrypted_resource_into_browser(HRSRC64, 0x18)

T1070.003Clear Command HistoryEvidence1

The malware uses the browser API to communicate with the servers. Here it uses the functionality of DeleteUrlCacheEntry() to delete the used URLs from the browser cache to delete traces.

T1070.004File DeletionEvidence1

The file 41082546.bat ... removes the installation file and itself.

T1574.009Path Interception by Unquoted PathEvidence1

The file is registered in HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\ ... mmcpapir : c:\windows\system32\ctfmreg.dll

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The following Registry keys are set up in HKEY_CURRENT_USER\Software\AppDataLow\{dd2706e2-58d9-ec64-3673-ca57d81d8ca1 }

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

The malware collects all browser history and cache files ... and collects cookie files from Internet Explorer, Firefox and Macromedia Flash Player.

T1649Steal or Forge Authentication CertificatesEvidence1

A main ability of the malware is the X.509 certificate stealing functionality ... enumerates and exports all certificates and also the private keys

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

Internet connections are proxy capable. Even username and passwords are read from the current browser configuration

T1082System Information DiscoveryEvidence1

Upload of basic environment information: OS: Microsoft Windows XP Professional Service Pack 3 ... ARCH: x86 32bit USER: Admin

Collection

1 technique

T1113Screen CaptureEvidence1

The malware contains functionality to take screenshots from the infected computer ... A screenshot is taken when the file contains the command “SCREENSHOT”.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

Immediately when a browser is opened, the following hosts are queried with HTTP POSTs ... Ask for command: POST http://wednesltr.com.tw/ucommd

T1090.001Internal ProxyEvidence1

The malware is able to create a reverse connection to a server on the internet, basically able to act as a proxy server for the attacker.

T1105Ingress Tool TransferEvidence1

The malware can retrieve an additional executable file and either save it ... save and run it ... save and make it autostart

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Upload of X.509 certificates ... encrypts them with the password 'password', compresses the file and sends it over the network

Impact

2 techniques

T1485Data DestructionEvidence1

When the malware receives the 'KILL' command, the inode of the Windows directory is overwritten with the malware module and a reboot is triggered. Overwriting the windows directory renders the Windows installation unusable.

T1529System Shutdown/RebootEvidence1

REBOOT ... Corrupt windows directory and reboot computer

Other

1 technique

T1562Impair DefensesEvidence1

it prevents basic investigation methods by not allowing various programs to start, like Sysinternals procmon.exe

INDICATORS OF COMPROMISE

IOCs tracked for this family

24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

11 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

13 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app11 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

secureworksNews

Jan 1, 2026

Gozi Trojan Threat Analysis

Referenced as malware with code similarities to Gozi.

circl luNews

Aug 14, 2026

Information-stealing backdoor/trojan that installs as a DLL, injects into processes, communicates with C2 over HTTP, steals X.509 certificates including private keys, browser cookies/history/cache, can take screenshots, download and execute additional modules, enable a SOCKS proxy, and corrupt Windows on command.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching24

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Snifula

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

Execution

3 techniques

T1059.003Windows Command ShellEvidence1

The file [8 decimal digits from GetTickCount()].bat ... Batch file to delete files after installation ... It removes the installation file and itself.

T1559Inter-Process CommunicationEvidence1

At this point in time, a communication pipe is established on the system. The pipe is part of the Inter Process Communication schema of the malware and used to execute commands.

T1574.009Path Interception by Unquoted PathEvidence1

The file is registered in HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\ ... mmcpapir : c:\windows\system32\ctfmreg.dll

Persistence

2 techniques

T1112Modify RegistryEvidence1

The following Registry keys are set up in HKEY_CURRENT_USER\Software\AppDataLow\{dd2706e2-58d9-ec64-3673-ca57d81d8ca1 }

T1547.001Registry Run Keys / Startup FolderEvidence1

save and make it autostart via HKCU\Software\\Microsoft\\Windows\\CurrentVersion\\Run

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

inject_decrypted_resource_into_browser(HRSRC32, 0x10) ... inject_decrypted_resource_into_browser(HRSRC64, 0x18)

T1547.001Registry Run Keys / Startup FolderEvidence1

save and make it autostart via HKCU\Software\\Microsoft\\Windows\\CurrentVersion\\Run

Stealth

4 techniques

T1055Process InjectionEvidence1

inject_decrypted_resource_into_browser(HRSRC32, 0x10) ... inject_decrypted_resource_into_browser(HRSRC64, 0x18)

T1070.003Clear Command HistoryEvidence1

The malware uses the browser API to communicate with the servers. Here it uses the functionality of DeleteUrlCacheEntry() to delete the used URLs from the browser cache to delete traces.

T1070.004File DeletionEvidence1

The file 41082546.bat ... removes the installation file and itself.

T1574.009Path Interception by Unquoted PathEvidence1

The file is registered in HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\ ... mmcpapir : c:\windows\system32\ctfmreg.dll

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The following Registry keys are set up in HKEY_CURRENT_USER\Software\AppDataLow\{dd2706e2-58d9-ec64-3673-ca57d81d8ca1 }

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

The malware collects all browser history and cache files ... and collects cookie files from Internet Explorer, Firefox and Macromedia Flash Player.

T1649Steal or Forge Authentication CertificatesEvidence1

A main ability of the malware is the X.509 certificate stealing functionality ... enumerates and exports all certificates and also the private keys

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

Internet connections are proxy capable. Even username and passwords are read from the current browser configuration

T1082System Information DiscoveryEvidence1

Upload of basic environment information: OS: Microsoft Windows XP Professional Service Pack 3 ... ARCH: x86 32bit USER: Admin

Collection

1 technique

T1113Screen CaptureEvidence1

The malware contains functionality to take screenshots from the infected computer ... A screenshot is taken when the file contains the command “SCREENSHOT”.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

Immediately when a browser is opened, the following hosts are queried with HTTP POSTs ... Ask for command: POST http://wednesltr.com.tw/ucommd

T1090.001Internal ProxyEvidence1

The malware is able to create a reverse connection to a server on the internet, basically able to act as a proxy server for the attacker.

T1105Ingress Tool TransferEvidence1

The malware can retrieve an additional executable file and either save it ... save and run it ... save and make it autostart

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Upload of X.509 certificates ... encrypts them with the password 'password', compresses the file and sends it over the network

Impact

2 techniques

T1485Data DestructionEvidence1

T1529System Shutdown/RebootEvidence1

REBOOT ... Corrupt windows directory and reboot computer

Other

1 technique

T1562Impair DefensesEvidence1

it prevents basic investigation methods by not allowing various programs to start, like Sysinternals procmon.exe

INDICATORS OF COMPROMISE

IOCs tracked for this family

24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

11 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

13 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app11 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

secureworksNews

Jan 1, 2026

Gozi Trojan Threat Analysis

Referenced as malware with code similarities to Gozi.

circl luNews

Aug 14, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching24

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.