Loading story…
ESET published a technical analysis of the Wslink malicious loader, describing a previously undocumented obfuscation scheme built around a nested two-layer virtual machine designed to frustrate reverse engineering. The white paper says the malware combines junk code, rolling decryption of operands, duplicated opcodes, opaque predicates, and merged instructions, creating a multilayered protection model that conceals the loader’s real logic and complicates static analysis.
Researchers used the Miasm framework and symbolic execution to build a semiautomatic deobfuscation method that recovered the semantics of virtual instructions, reconstructed control-flow graphs, and exposed at least part of the protected code. ESET said it validated the approach by comparing recovered logic from a virtualized bytecode block with a non-obfuscated Wslink sample, and added that the malware appears unique, with no code, functionality, or operational links to any known threat actor.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
In March 2022, ESET Research published a white paper analyzing Wslink, a previously undocumented malicious loader that runs as a server and uses a multilayer virtual-machine-based obfuscator. The paper said ESET found no code, functionality, or operational similarities linking Wslink to a known threat actor.
On October 27, 2021, ESET published research on Wslink, a previously undocumented Windows loader that unusually runs as a server, receives encrypted modules, and executes them in memory. ESET said it had observed only a few detections over the prior two years, found no links to any known threat actor, and released technical details and sample hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceattack.mitre.org
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026
Researchers published detailed reverse-engineering work on **FinFisher/FinSpy** spyware, showing how the surveillance tool hides its payload behind heavy anti-analysis protections and a proprietary virtual machine. ESET documented Windows samples that use complementary conditional-jump pairs after nearly every instruction to break disassembly, then decrypt and execute protected bytecode through a custom virtual CPU. The whitepaper describes how analysts can peel back those layers by reconstructing components such as `vm_start`, `vm_dispatcher`, `vm_context`, and `vm_handlers`, noting that the examined VM used **34 handlers** and could mix virtualized logic with native instructions when full virtualization was impractical. Additional reverse-engineering research expanded on that work by demonstrating how to simplify and devirtualize FinSpy bytecode into equivalent x86 logic. The analysis focused on removing instruction patterns tied to a dedicated **SCRATCH** register, replacing them with canonical VM forms or direct x86 operations, and decoding sequences that represented x86-style memory addressing and memory access. After those transformations, the remaining bytecode was reduced largely to branch and raw x86-related instructions, and the researcher also corrected an earlier interpretation of one opcode, concluding that a supposed `CRASH` instruction was actually an unconditional jump. Together, the findings show that FinFisher’s protections were built to frustrate reverse engineering and conceal configuration data and newer spyware capabilities.
Aug 14, 2026
Researchers detailed how **SmokeLoader** continues to operate as a heavily obfuscated, multi-stage malware loader that hides its execution flow and decrypts later payloads in memory before contacting command-and-control infrastructure. Reverse-engineering of recent samples showed opaque predicate obfuscation, encrypted functions, API hashing based on `djb2` with an added XOR layer, and a compressed third stage that is decrypted with XOR keys before being unpacked with **LZSA2**. Analysts also reported that the final decrypted stage can have a damaged PE header while retaining usable sections, complicating static analysis but still allowing recovery of configuration data such as RC4-encrypted strings and multiple C2 URLs. Separate analysis traced a Visual Basic Script infection chain that used `wscript.exe` to launch an obfuscated PowerShell downloader, which then fetched an executable from `americanocoffea[.]ru` into the victim's temp directory and executed it as a SmokeLoader payload. One investigated sample was observed delivering the **Vidar** infostealer, reinforcing SmokeLoader’s role as a malware distribution platform rather than a single-purpose implant. Public research from CERT Polska and independent analysts collectively highlights SmokeLoader’s layered packing, staged delivery, and reusable infrastructure as key factors that make the malware effective for initial access and follow-on payload deployment.
Aug 15, 2026