Loading malware…
StealthVector is a Windows shellcode loader associated with the China-linked espionage actor tracked as Earth Baku, also known as APT41. It has been used in campaigns targeting organizations across the Indo-Pacific region, including sectors such as airlines, automotive, infrastructure, publishing, media, information technology, and computer hardware, and has also been observed in intrusions linked to broader APT41 activity.
StealthVector is implemented in C/C++ and is designed to decrypt and launch second-stage payloads in memory. Observed payloads include the modular backdoor ScrambleCross and Cobalt Strike Beacon. The loader emphasizes stealth and flexible execution. Reported capabilities include disabling Event Tracing for Windows, checking the current username for context awareness, configurable payload placement, and optional self-uninstallation after execution. Execution methods attributed to StealthVector include direct thread creation, local module stomping, Control Flow Guard bypass, and phantom DLL hollowing into remote processes. Some variants patch functionality in ntdll to facilitate CFG bypass.
Configuration data has been reported as encrypted with ChaCha20 using a nonstandard initial counter, while later related variants introduced stronger obfuscation and different cryptographic routines. StealthVector and its successor lineage have also been noted to re-encrypt payload material after initial execution using XOR keyed to the victim computer name, complicating forensic recovery and analysis.
StealthVector has been delivered through multiple intrusion chains. Documented access vectors in operations using this loader include SQL injection against public-facing applications backed by Microsoft SQL Server, exploitation of Microsoft Exchange ProxyLogon vulnerability CVE-2021-26855 to deploy web shells and follow-on malware, and a possible malicious attachment chain involving shortcut files. It has also been installed for persistence as a Windows service and loaded through DLL-based execution chains.
StealthVector is part of a malware family cluster that evolved alongside StealthMutant, a .NET implementation with similar purpose, and later loader variants such as StealthReacher and DodgeBox. It has also been observed in environments where ScrambleCross was deployed as an in-memory modular implant. The malware reflects a mature post-exploitation toolkit focused on covert payload delivery, defense evasion, and long-term espionage operations on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Our analysis indicates that Earth Baku employs previously unidentified pieces of malware in this campaign: two shellcode loaders, which we have named StealthVector and StealthMutant, and a backdoor, which we have dubbed ScrambleCross.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Compared to the older StealthVector, it uses AES algorithms for encryption and MD5 hashing for checksum. It’s noting that both StealthVector and StealthReacher will perform re-encryption after the first initiation via XOR encryption, with the key being the victim’s computer name.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Earth Baku performed an SQL injection attack on the victim’s web application to gain a foothold in the network... Another method involves a China Chopper web shell that is uploaded to Microsoft Exchange Server by exploiting the ProxyLogon vulnerability CVE-2021-26855.
StealthReacher (aka DodgeBox) can be considered as an enhanced variant of StealthVector, featuring code obfuscation techniques such as FNV1-a and other defense evasion mechanisms. | both StealthVector and StealthReacher will perform re-encryption after the first initiation via XOR encryption, with the key being the victim’s computer name.
Compared to the older StealthVector, it uses AES algorithms for encryption and MD5 hashing for checksum.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A shellcode loader written in C/C++ with configurable features including self-uninstall, payload execution at a specific location, ETW disabling for evasion, and username checking for context awareness. Its configuration is encrypted with ChaCha20 using a fixed custom initial counter.
Referenced as a malware/tool conceptually similar to DodgeBox in reflective DLL loading behavior.
An older loader related to StealthReacher that performs payload re-encryption after first initiation using XOR with the victim computer name as key.
C++ DLL loader for ScrambleCross/SideWalk that decrypts an encrypted shellcode blob (modified ChaCha20) and loads it in-memory; observed being side-loaded via a modified benign system DLL (IAT patching) to force its load (e.g., via WMI service DLL hijack).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.