Loading story…
Darktrace published a technical walkthrough of unpacking and analyzing SnappyBee (aka Deed RAT), a modular backdoor previously reported in China-linked espionage activity attributed to Salt Typhoon (aka Earth Estries). The write-up describes SnappyBee as typically deployed post-compromise to establish persistence and enable follow-on tooling (including Cobalt Strike and the Demodex rootkit), and highlights its use of a custom packing routine intended to obscure the payload and hinder static analysis.
Zscaler ThreatLabz detailed GuLoader’s evolving obfuscation methods designed to evade detection and frustrate reverse engineering. Techniques described include polymorphic “dynamic constant construction” (building constants at runtime via instruction sequences like mov, xor, add, sub) and exception-based control-flow redirection that replaces normal jmp logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., 0x80000003 STATUS_BREAKPOINT, 0x80000004 STATUS_SINGLE_STEP, 0xC0000005 STATUS_ACCESS_VIOLATION), complicating automated tracing and signature-based detection.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Darktrace released an educational analysis of the SnappyBee (Deed RAT) modular backdoor, describing its DLL side-loading chain, ARC4-based in-memory decryption, nested unpacking, and debugging-based extraction method, along with sample SHA-256 indicators.
Zscaler ThreatLabz published a technical analysis of GuLoader’s evolving obfuscation and evasion methods and released IDA scripts to help analysts recover constants and strings and remove exception-based control-flow obfuscation.
In versions observed after 2022, GuLoader updated its dynamic hashing by combining DJB2 with extra XOR operations and a hardcoded DWORD to resolve APIs and identifiers while limiting static indicators.
Across 2024 into 2025, GuLoader broadened its exception-based control-flow obfuscation to support additional exception types and more complex jump-target calculations, including hardcoded offsets and dynamically generated XOR keys.
In 2023, GuLoader evolved its string protection by constructing and decrypting strings on the stack at runtime, reducing the effectiveness of static signatures and making emulation more useful for recovery.
By 2022, GuLoader samples used statically stored XOR-encrypted strings, dynamic constant construction, API hashing, and exception-based control-flow obfuscation to hinder static analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new **PDFly** malware variant that uses a **custom-modified PyInstaller** executable to break common unpacking workflows and force manual reverse engineering. The sample alters PyInstaller identifiers (including a non-standard “magic cookie”) and corrupts strings so tools like *PyInstxtractor* fail to recognize the archive structure; even after adapting extraction scripts to accept the custom cookie and bypass validation checks, the recovered Python components remained **multi-layer encrypted**, with decryption logic implemented in separate bootstrap files that handle runtime extraction. Separately, an educational malware-analysis write-up detailed how to unpack **SnappyBee (Deed RAT)**, a modular backdoor previously reported in China-linked espionage activity and associated in public reporting with **Salt Typhoon / Earth Estries**. The post describes SnappyBee’s **custom packing routine** used to obscure its payload and evade static analysis, and positions the unpacking methodology as a repeatable approach for triaging similarly packed malware (including post-compromise tooling used for persistence and follow-on deployment such as **Cobalt Strike** and the **Demodex** rootkit).
Jun 29, 2026
Darktrace published a technical deep-dive on **SnappyBee** (aka **Deed RAT**), a **modular backdoor** attributed to the China-linked espionage group **Salt Typhoon** (aka **Earth Estries**). The reporting describes SnappyBee as a *post-compromise* persistence tool used to entrench access and enable follow-on activity, including deployment of additional payloads such as **Cobalt Strike** and the **Demodex** rootkit. Darktrace’s write-up is positioned as an educational guide for analysts, walking through unpacking and analysis techniques to reverse engineer SnappyBee’s custom packing and runtime execution behavior. Additional coverage highlighted key tradecraft used by SnappyBee to reduce detection, including a **custom packing routine** and **DLL side-loading** via a legitimate signed executable vulnerable to side-loading, helping the malware blend into trusted processes. The analysis also notes SnappyBee’s use of dynamically resolved Windows APIs (e.g., `VirtualProtect`, `StartServiceCtrlDispatcherW`) and in-memory manipulation to avoid static signatures and maintain stealthy persistence. Separately, a Cybereason-described campaign involving **Silver Fox APT** and **ValleyRat/Winos 4.0** using “PoolParty Variant 7” process injection is unrelated to SnappyBee/Salt Typhoon and should not be conflated with this reporting.
Jun 29, 2026
Researchers detailed two malware loaders used to establish initial access and stage follow-on intrusions: **SquirrelWaffle**, which arrived through phishing documents and dropped VBS and PowerShell components before retrieving a packed 32-bit DLL, and **Bumblebee**, which was delivered through compromised open-source tools in an MSI installer containing a CAB archive. In the SquirrelWaffle chain, the DLL dropper unpacked shellcode using XOR/ROR logic and APLIB decompression, then loaded a payload exported as `ldr` that collected host data, decrypted embedded configuration, and extracted command-and-control IP addresses and domains. The malware communicated over standard `WS_32` socket APIs and downloaded **Cobalt Strike**, saving the binary with a `.txt` extension before execution. Analysis of Bumblebee showed a different but similarly stealthy execution path built around **DLL sideloading** and **DLL proxy forwarding**. The installer abused the legitimate Microsoft-signed `icardagt.exe` binary to load a malicious DLL that was renamed to `version.dll` at runtime, while anti-analysis features included junk code, timing checks, and possible virtual-machine detection through WMI queries. Investigators also observed failed file-creation attempts, a network connection to `19ak90ckxyjxc.life`, a temporary installation directory, and a Windows Installer `UserData` registry artifact, reinforcing that the MSI package orchestrated the full infection chain and positioned the malware for later hands-on-keyboard activity or ransomware deployment.
Jun 29, 2026