Loading malware…
HOTCROISSANT is a Windows beacon-style implant with remote-access-trojan functionality associated with North Korea’s Lazarus Group, also known as Hidden Cobra. It is designed to establish a foothold on compromised hosts, transmit victim information to command-and-control infrastructure, and await operator tasking. Reported capabilities include real-time screen viewing, process and service enumeration, collection of the current username and host IP address, and file transfer from the victim to the operator, supporting reconnaissance and data exfiltration after compromise. HOTCROISSANT has also been observed attempting to establish persistence through a scheduled task disguised with a legitimate-looking name and includes cleanup functionality to remove installed components and delete itself from the system. For stealth and evasion, it can hide windows associated with file operations, dynamically resolve APIs through obfuscated strings, and protect network communications using compressed and XOR-encoded or custom stream-cipher-encrypted traffic. It has been characterized as a full-featured implant used in Lazarus intrusion operations against Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
HOTCROISSANT is a full beacon-style (Cobalt Strike style) implant with RAT-like functionality. Network traffic is encoded via XOR.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.
APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor malware capable of hiding windows associated with file operations.
Malware family previously deployed via ERP vendor supply-chain compromise (not further described in the content).
Backdoor capable of collecting the username on the infected host.
Identifies the IP address of compromised machines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.