S9027 ANELLDR

malwareEnterprise

platformsWindows

also known asANELLDR

ANELLDR, a loader that has been in use since at least 2018, was designed to decrypt and execute UPPERCUT in memory. ANELLDR can use anti-analysis techniques and is known to share code overlap with HiddenFace.

techniques used (8)

ATT&CK techniques this enables or maps to.

T1027Obfuscated Files or Information
T1027.013Encrypted/Encoded File
T1027.016Junk Code Insertion
T1083File and Directory Discovery
T1106Native API
T1140Deobfuscate/Decode Files or Information
T1574.001DLL
T1622Debugger Evasion

used by campaigns (1)

Campaigns that use this.

C0060Operation AkaiRyū

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan