Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The third branch, Docro Hijacker, altered Chrome's protected preferences with valid integrity signatures.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
“The group runs a pay-per-install service, using YouTube channels and SEO-poisoning campaigns to distribute malware through a custom loader.”
“The SEO funnel delivered trojanized software to corporate, government, and critical infrastructure targets.”
Docro Hijacker altered Chrome’s protected preferences with valid integrity signatures. It changed the default search provider and side-loaded a browser extension.
Docro Hijacker... changed the default search provider and side-loaded a browser extension that could rewrite requests, inject material into search-result pages, alter affiliate links, and redirect clicks.
“OfferLoader masquerading as a windirstat.exe installer”; it was also delivered alongside legitimate WinRAR renamed to “.store.”
Docro Hijacker altered Chrome’s protected preferences with valid integrity signatures. It changed the default search provider and side-loaded a browser extension.
OfferLoader used a trojanized Inno Setup installer to start the next stages. After a tracking check, it launched three child processes for separate malware operations.
After a tracking check, it launched three child processes for separate malware operations... [Insomnia RAT] can... download files... The third branch... side-loaded a browser extension.
106 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.