Loading malware…
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The Udydn payload uses cmd /c to execute the decoded staged command; observed commands included whoami & ver and whoami & ver & tasklist. | cmd /c "whoami & ver" as SYSTEM under pc-app.exe.
The payload selects /bin/sh -c on non-Windows systems based on the os.name Java property. | String[] argv = isWin ? ... : new String[] { "/bin/sh", "-c", decoded };
A final configuration write points user-lookup.db-driver at the class name Udydn. The next connection attempt performs the unsafe dynamic instantiation—Class.forName("Udydn")—and because Java executes a class's static initializer at load time, merely loading the class detonates the payload. | A final configuration write points user-lookup.db-driver at the class name Udydn; the next connection attempt performs Class.forName("Udydn"), causing its static initializer to run.
The payload's cleanup thread sleeps twenty seconds, then deletes logs/server.log and every server.log.* rotation, deletes data/internal/derby.log, and removes its own staging files and class. | The payload sleeps twenty seconds, then deletes logs/server.log and rotations, data/internal/derby.log, its .cmd/.out staging files, and its own class file.
In incident one ... the decoded command was whoami & ver—pure environment validation: which identity did I land as. | In the first incident, the decoded command was whoami & ver; the whoami command was used to determine which identity the attacker obtained.
The second observed incident used whoami & ver & tasklist, adding process enumeration. | In incident two ... the command grew to whoami & ver & tasklist, adding process enumeration.
the decoded command was whoami & ver—pure environment validation: which identity did I land as, and which OS build is this? | Observed commands included whoami & ver, with ver used to identify the operating-system build.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.