sRDIMalware
- daveshell
sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped to a packed DLL.From MISP Galaxy
Last reported 3 days ago, by Huntress5 reports
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1036Masquerading
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1055Process Injection
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1620Reflective Code Loading
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1027Obfuscated Files or Information
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1055.002Portable Executable Injection
“Process Injection: Portable Executable Injection”
- T1055.012Process Hollowing
“The sRDI component injects the stealer into memory through process hollowing, and the malware immediately begins beaconing.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware“It turns out that the smaller of the two files is a shellcode reflective DLL injector (or sRDI), essentially a loader for the larger file.”
-
Operation FlashHole: Lazarus breaks security, defies control“The shellcode can be generated using the open‑source sRDI tool to package a DLL‑style plugin.”
-
SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk“The shellcode loading methods have also continued to evolve, including the use of sRDI, Donut Loader, the addition of XOR operations, a shift from CreateFile to VirtualAlloc-based loading, and the application of code virtualization.”
-
PikaBot: a Guide to its Deep Secrets and Operations“…ther information and details on this technique are discussed in the Outflank article: Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR.”
-
You've Got Malware: FINALDRAFT Hides in Your Drafts“This shellcode injected by FINALDRAFT leverages the well-known sRDI project, enabling the loading of a fully-fledged PE DLL into memory within the same process, resolving its imports and calling its export entrypoint.”
Indicators in its reports
named in the reports above- sites.google[.]comin 1 report
- hxxps://ipinfo[.]io/jsonin 1 report
- 959da0fb174a8e4d…76a2f43c0f25in 1 report
- data[.]datain 1 report
- lordless[.]namein 1 report
- resonancessewars[.]tiresin 1 report
- alkaliesnonperspective[.]fishin 1 report
- demonising[.]liin 1 report
- callipersoutane[.]comin 1 report
- issuer[.]countryin 1 report
- hxxps://redops[.]at/en/blog/direct-syscalls-vs-indirect-syscallsin 1 report
- redops[.]atin 1 report
- hxxps://www.vmray[.]com/cyber-security-blog/why-your-edr-let-pikabot-jump-through/in 1 report
- www.vmray[.]comin 1 report
- hxxps://victorbush[.]com/2015/04/the-anti-rootkit-rootkit/in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.