GUIDLOADERMalware
Last reported 12 months ago, by Elastic Security Labs2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1021.006Windows Remote Management
“Windows Remote Management’s Remote Shell plugin (WinrsHost.exe) was used to download the files to this system from an unknown source system on a connected network.”
- T1053.005Scheduled Task
“Persistence was achieved using a Scheduled Task that invoked the renamed CDB.exe debugger and the weaponized INI file every minute as SYSTEM.”
What the reports say
2 reports, newest first · the exact sentence from each-
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape“REF7707, a threat campaign involving the FINALDRAFT, PATHLOADER, and GUIDLOADER malware families, provides details about how an espionage-motivated threat evaded defenses using Microsoft’s GraphAPI for C2.”
-
From South America to Southeast Asia: The Fragile Web of REF7707“The intrusion set utilized by REF7707 includes novel malware families we refer to as FINALDRAFT, GUIDLOADER, and PATHLOADER.”
Indicators in its reports
named in the reports above- mrd0x[.]comin 1 report
- poster.checkponit[.]comin 1 report
- support.fortineat[.]comin 1 report
- support.vmphere[.]comin 1 report
- update.hobiter[.]comin 1 report
- checkponit[.]comin 1 report
- 9a11d6fcf76583f7…f6f959853bcfin 1 report
- 39e85de1b1121dc3…0c833e059530in 1 report
- 83406905710e52f6…1fdb2d28cc8cin 1 report
- 08331f33d196ced2…e2b1dc298cc1in 1 report
- cffca467b6ff4dee…272b683205f9in 1 report
- 6d79dfb00da88bb2…1473297617e3in 1 report
- digert.ictnsc[.]comin 1 report
- andsupport.vmphere[.]comin 1 report
- hxxps://support.vmphere[.]comin 1 report
- fromposter.checkponit[.]comin 1 report
- hobiter[.]comin 1 report
- 47.83.8[.]198in 1 report
- 8.218.153[.]45in 1 report
- autodiscovar[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.