Loading story…
Researchers detailed how the ReZer0 .NET loader can be analyzed without running its main entry point, allowing defenders to automatically recover both its embedded payload and configuration. The technique uses C# reflection to load samples as assemblies, enumerate private static fields across classes, identify the payload as a byte array beginning with the MZ header, and locate the configuration as a 37-element string array. Because those static fields are populated when the assembly loads, the method exposes already-decrypted data and sidesteps the loader’s encryption and decryption logic.
The recovered configurations show ReZer0 supports multiple execution and evasion features, including process hollowing, scheduled task creation, remote payload execution, anti-virtualization, anti-sandbox checks, message-box display, and sleep-based delays. The extractor was reportedly validated against 215 samples, with example outputs showing differing configuration values and payloads across campaigns, while separate reporting on .NET loader tradecraft underscores continued attention on loaders that conceal second-stage malware inside managed code.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
An article published the technical method for automatically extracting ReZer0's embedded payload and configuration by loading samples as .NET assemblies and enumerating private static fields. It documented that the approach bypasses the loader's encryption and decryption routines because the relevant data is already assigned when the assembly is loaded.
The article states the C# extractor for the ReZer0 .NET loader was tested against 215 samples found during prior research. The tool uses .NET reflection to recover the embedded payload and 37-element configuration without executing the loader's main entry point.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zloader, a **ZeuS-derived banking trojan** that steals browser data, cookies, passwords, screenshots, and other host information, was used in multiple campaigns that combined layered delivery chains with strong evasion and persistence. Researchers documented malspam operations using **MHTML attachments**, password-protected XLS files, VBA and XLM macros, and `rundll32.exe`, as well as a later campaign that used the legitimate RMM tool **Atera** for initial access. In that operation, attackers weakened Microsoft Defender, disabled investigation tools, and abused a weakness in **Microsoft Authenticode** by appending malicious script content to Microsoft-signed DLLs while preserving a seemingly valid signature, then launching the script with `mshta.exe` and executing Zloader through `regsvr32.exe`. Across samples, Zloader commonly injected its core payload into a suspended `msiexec.exe` process, stored encrypted configuration data, and maintained persistence through Startup-folder scripts and Windows Run keys. Technical analyses showed Zloader evolving into a **modular malware platform** with anti-analysis features including encrypted strings, runtime API resolution, filename checks, process injection, and heavy **API hammering** that can generate more than a million file or registry-related calls before payload execution. Newer variants retained RC4-encrypted configuration data but added revised domain-generation logic and network protections using **RSA**, **RC4**, and Zeus BinStorage-style encryption over HTTP POST. Microsoft, ESET, Lumen Black Lotus Labs, Palo Alto Networks Unit 42, and others later disrupted three Zloader botnets by seizing **65 active command-and-control domains** and **319 DGA-generated domains**, while reporting that the malware had been tracked since 2019 across roughly **14,000 unique samples** and more than **1,300 C2 servers**, with some affiliates tied to **DarkSide ransomware**, **Cobalt Strike**, **Raccoon infostealer**, and large victim populations in North America.
Aug 15, 2026
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026
Researchers detailed how **SmokeLoader** continues to operate as a heavily obfuscated, multi-stage malware loader that hides its execution flow and decrypts later payloads in memory before contacting command-and-control infrastructure. Reverse-engineering of recent samples showed opaque predicate obfuscation, encrypted functions, API hashing based on `djb2` with an added XOR layer, and a compressed third stage that is decrypted with XOR keys before being unpacked with **LZSA2**. Analysts also reported that the final decrypted stage can have a damaged PE header while retaining usable sections, complicating static analysis but still allowing recovery of configuration data such as RC4-encrypted strings and multiple C2 URLs. Separate analysis traced a Visual Basic Script infection chain that used `wscript.exe` to launch an obfuscated PowerShell downloader, which then fetched an executable from `americanocoffea[.]ru` into the victim's temp directory and executed it as a SmokeLoader payload. One investigated sample was observed delivering the **Vidar** infostealer, reinforcing SmokeLoader’s role as a malware distribution platform rather than a single-purpose implant. Public research from CERT Polska and independent analysts collectively highlights SmokeLoader’s layered packing, staged delivery, and reusable infrastructure as key factors that make the malware effective for initial access and follow-on payload deployment.
Aug 15, 2026