PATHLOADERMalware
Last reported 10 months ago, by Elastic Security Labs4 reports
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1567Exfiltration Over Web Service
“Exfiltration Over Web Service”
- T1021.006Windows Remote Management
“Windows Remote Management’s Remote Shell plugin (WinrsHost.exe) was used to download the files to this system from an unknown source system on a connected network.”
- T1036.001Invalid Code Signature
“Masquerading: Invalid Code Signature”
- T1053.005Scheduled Task
“Persistence was achieved using a Scheduled Task that invoked the renamed CDB.exe debugger and the weaponized INI file every minute as SYSTEM.”
- T1055Process Injection
“FINALDRAFT is a 64-bit malware written in C++ that focuses on data exfiltration and process injection.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
NANOREMOTE, cousin of FINALDRAFT“…ed that the WMLOADER decrypts the corresponding payload from a hard-coded file named wmsetup.log – the same file name that was used by PATHLOADER to deploy FINALDRAFT that we published earlier in the year.”
-
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape“REF7707, a threat campaign involving the FINALDRAFT, PATHLOADER, and GUIDLOADER malware families, provides details about how an espionage-motivated threat evaded defenses using Microsoft’s GraphAPI for C2.”
-
From South America to Southeast Asia: The Fragile Web of REF7707“The intrusion set utilized by REF7707 includes novel malware families we refer to as FINALDRAFT, GUIDLOADER, and PATHLOADER.”
-
You've Got Malware: FINALDRAFT Hides in Your Drafts“PATHLOADER”
Indicators in its reports
named in the reports above- poster.checkponit[.]comin 2 reports
- support.fortineat[.]comin 2 reports
- support.vmphere[.]comin 2 reports
- update.hobiter[.]comin 2 reports
- checkponit[.]comin 2 reports
- 9a11d6fcf76583f7…f6f959853bcfin 2 reports
- 39e85de1b1121dc3…0c833e059530in 2 reports
- 83406905710e52f6…1fdb2d28cc8cin 2 reports
- hxxps://ipinfo[.]io/jsonin 1 report
- mrd0x[.]comin 1 report
- 558bec83ec40535657833d7440001c00in 1 report
- 1e28c01387e0f0229a3fb3df931eaf80in 1 report
- fff31726d253458f…71c4014d6902in 1 report
- 999648bd814ea5b1…b9e6f4121475in 1 report
- 35593a51ecc14e68…8371ff4f8d41in 1 report
- b26927ca4342a19e…81d692eaa73cin 1 report
- 57e0e560801687a8…c0040205d728in 1 report
- hxxps://poster.checkponit[.]com/nzoMeFYgvjyXK3P;https://support.fortineat.com:443/nzoMeFYgvjyXK3P;*in 1 report
- hxxp://poster.checkponit[.]com/nzoMeFYgvjyXK3Pin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/tokenin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.