Loading story…
Palo Alto Networks Unit 42 detailed how analysts defeated anti-analysis protections in BazarLoader, a Windows backdoor linked to multiple ransomware operations, to accelerate reverse engineering and expose its behavior. The research focused on two obfuscation methods in a BazarLoader sample: API function hashing that concealed Windows API calls and opaque predicates that distorted control-flow analysis and decompilation. By reversing those protections, analysts were able to recover hidden functionality and better map the malware’s execution path.
The team used IDAPython with IDA Pro’s Appcall feature to invoke BazarLoader’s own API-decoding routine during debugging, automatically recover dynamically resolved API names, and annotate calls. They also identified and patched opaque predicates so dead code blocks were removed and decompiled output became clearer. After applying those techniques, the researchers identified behaviors including code injection and determined that one heavily obfuscated routine acted as a wrapper for GetModuleFileNameW(), with accompanying GitHub-hosted scripts provided to automate API deobfuscation and opaque-predicate patching.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Unit 42 published research detailing how to defeat BazarLoader anti-analysis techniques, including API function hashing and opaque predicates, using IDAPython and IDA Pro Appcall. The write-up also referenced GitHub-hosted scripts for resolving obfuscated API calls and patching opaque predicates.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **BazarLoader** evolved as an enterprise-focused malware loader tied to the TrickBot ecosystem, using the decentralized `.bazar` namespace on EmerDNS/OpenNIC for command-and-control and rotating algorithmically generated domains each month. Early variants generated 12-character domains and later shifted to 8-character patterns built from consonant-vowel pairs, expanding the monthly candidate pool from about 2,160 to 12,996 domains; one later variant contained a coding flaw that caused many summer-month domains to become invalid, disrupting parts of its own DGA-based infrastructure. Separate reverse-engineering of BazarLoader’s infection chain showed the malware commonly arrived through phishing and malicious ISO files, where an `LNK` launched a DLL via `rundll32.exe`, unpacked shellcode, and exposed the final loader. The loader used anti-analysis checks, language-based execution filtering, dynamic API resolution, decoy traffic, cryptographic validation, and process hollowing, then fetched follow-on payloads from hard-coded HTTPS IPs or fallback `.bazar` domains to deliver tools such as **Cobalt Strike** and **Conti ransomware**.
Aug 15, 2026
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026
Check Point Research detailed an **APT32 (Ocean Lotus)** backdoor sample that used control-flow obfuscation to frustrate reverse engineering while delivering a multi-stage infection chain. The attack began with a malicious document disguised as a **Qihoo 360** file, used **VBA macros** to inject shellcode into `rundll32.exe`, then decrypted and reflectively loaded a DLL before launching an auxiliary `HTTPProv.dll` module for command-and-control communications. The analysis showed the malware inserted junk basic blocks into functions, often by placing opposite conditional jumps that led to the same target, making flow graphs appear far more complex than they were. To counter that technique, the researcher released a Python-based **Graph Deobfuscator** plugin for **Cutter** and **radare2** using `r2pipe`, which patches those conditional branches into unconditional jumps in memory and reanalyzes the function graph without altering the original binary on disk by relying on radare2 cache mode.
Aug 14, 2026