VileLoader
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This malware is consistently seen being deployed by an accompanying loader known as VileLoader, used to run VileRAT in-memory, limiting on-disk artifacts.
This malware is consistently seen being deployed by an accompanying loader known as VileLoader, used to run VileRAT in-memory, limiting on-disk artifacts.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Back in the summer of 2020, DeathStalker’s VileRAT initial infection consisted in spear-phishing emails sent to foreign exchange companies... More recently... the initial infection vector is still a malicious message: a Word document (DOCX) is sent to targets via email.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
6 techniques
Stealth
This payload and its filename are both obfuscated using XOR-based encoding methods... VileRAT’s core component is stored in a compressed, Xored, and base64 encoded buffer...
When executed, it validates the passed command line argument ... before dynamically resolving imports related to file loading and process execution.
Stairwell has observed new activity and has identified new variants of VileRAT being deployed by modified versions of legitimate installers that contain VileLoader.
VileLoader then opens its encoded companion shellcode file... maps the deobfuscated data in a region with read, write and execute (RWX) permissions, and runs the next stage (stage 2) by starting a new thread.
Discovery
2 techniques
Discovery
the DOTM-embedded macro silently gathers information about security products that are installed on the target computer... VileDropper: gathers additional data on the targeted environment... The JSON that is passed to the C2 server can be broken down as follows... host, uname, Windows version.
Collection
1 technique
Collection
Command and Control
4 techniques
Command and Control
The useful information is stored as a JSON document... and set as a cookie value in the HTTP request... VileLoader stage 2 sends an HTTP POST request with a cookie whose value is a XORed JSON dictionary.
VileDropper sends data to a C2 server using an HTTP GET request... VileLoader’s second stage builds an HTTP GET request... VileRAT tries to send an HTTP POST request to each of the C2 servers that exist in its configuration.
VileLoader’s main goal is to download and execute an additional payload from a C2 server... If the C2 server answers with an implant package, it sends a Type D XORed blob... contains one or several “files”... Finally, the last dropped file is also immediately executed.
IOCs tracked for this family
249 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader used to execute VileRAT in memory while minimizing on-disk artifacts; observed embedded in modified legitimate installers and used to unpack/write the encoded VileRAT payload.
A multi-stage evasive loader/downloader used in the VileRAT infection chain. It decodes and executes shellcode, communicates with C2, can request screenshots, downloads implant packages, establishes persistence with scheduled tasks, and commonly delivers VileRAT.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.