HLOADERMalware
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 13 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing”
- T1036Masquerading
“Stage 3 (HLOADER) - HLOADER/Discord(fake) is a simple loader used as a persistence mechanism masquerading as the legitimate Discord app for the loading of SUGARLOADER.”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Python”
- T1059.004Unix Shell
“Command and Scripting Interpreter: Unix Shell”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic catches DPRK passing out KANDYKORN“SUGARLOADER reflectively loads a binary (KANDYKORN) and then creates a new file initially named appname which we refer to as HLOADER which we took directly from the process code signature’s signing identifier.”
Indicators in its reports
named in the reports above- 23.254.226[.]90in 1 report
- 2360a69e5fd7217e…0234f7762df1in 1 report
- discord[.]appin 1 report
- 5555494485b460f1…b94d01136320in 1 report
- hxxps://drive.google[.]com/file/d1KW5nQ8MZccug6Mp4QtKyWLT3HIZzHNIL2in 1 report
- 192.119.64[.]43in 1 report
- pesnam.publicvm[.]comin 1 report
- bitscrunnch.linkpc[.]netin 1 report
- jobintro.linkpc[.]netin 1 report
- jobdescription.linkpc[.]netin 1 report
- docsenddata.linkpc[.]netin 1 report
- docsendinfo.linkpc[.]netin 1 report
- datasend.linkpc[.]netin 1 report
- exodus.linkpc[.]netin 1 report
- bitscrunnch.run[.]placein 1 report
- coupang-networks[.]picsin 1 report
- group.pro-tokyo[.]topin 1 report
- hxxps://github[.]com/Prtofin 1 report
- hxxps://github[.]com/wokurksin 1 report
- 3ea2ead8f3cec030…fe8a6cb59940in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.