> Family · unattributed_

~/packetpursuit $ cat /intel/families/unattributed.md

confidencemediumupdated2026-09-04

unattributed

Umbrella entity for malware samples that do not yet map to a known family or cluster. This page collects singletons and low-confidence attributions until a sibling cluster emerges.

Capabilities

  • javascript-obfuscator-cff-rc4-dropper (sample 6f4de3f9, JScript WSH dropper with 2,844-entry string array, swapped base64 alphabet, control-flow flattening, and SmartScreen/Defender disable payload)

  • dotnet-6-self-contained

  • websocket-json-c2

  • windows-service-persistence

  • registry-query-modify

  • process-create-terminate-suspend

  • mutex-gating

  • unmanaged-memory-manipulation

  • dotnet-assembly-reflective-loading

  • newtonsoft-json-serialization

  • heavy-string-obfuscation

  • autoit-hex-split-obfuscation

  • callwindowproc-injection

  • peb-walking-api-resolution

  • reflective-pe-loader

  • xor-encrypted-pe-staging

  • python-embeddable-callback-injection

  • enumdesktopwindows-rwx-callback

  • multi-layer-python-obfuscation

  • widgetservice-masquerade

  • sleep-anti-emulation

  • virtualalloc-rwx-memmove

  • msvc-pogo-reflective-loader

  • xor-not-alphabet-cipher

  • lcg-prng-c2-url-generation

  • cpuid-hypervisor-vm-gate

  • msvc-pogo-reflective-loader-twin (sample 3b42403b, individualized encrypted payload in shared stub)

  • msvc-pogo-reflective-loader-twin (sample 21b12514, third confirmed sibling with individualized .data payload and unique section hashes, same stub template)

  • msvc-pogo-reflective-loader-twin (sample 73841818, ninth confirmed sibling in blackmatter-tagged cluster, identical stub template with individualized .data payload and PE checksum 0x000306CE)

  • msvc-pogo-reflective-loader-twin (sample 0017ecc5, tenth confirmed sibling in blackmatter-tagged cluster, identical stub template with individualized .data payload and PE checksum 0x0002FF42)

  • msvc-pogo-reflective-loader-twin (sample 21b12514, third confirmed sibling with individualized .data payload and unique section hashes, same stub template)

  • msvc-pogo-reflective-loader-twin (sample ae02bd22, fourteenth confirmed sibling, same .text hash as 21b12514, individualized .data payload, no blackmatter OpenCTI label, PE checksum 0x0002BE18) ^[/intel/analyses/ae02bd22cede04bdb3d48b0e32a9611c9352f28e2ddaf56af55112fdb8b2cc17.html]

  • themida-packed-boot-lz77 (sample 616740a4, Themida-packed x64 PE with .boot section entry point, LZ77 decompressor, blank section names, minimal IAT)

  • themida-packed-boot-lz77 (sample 01372355, Themida-packed x64 PE with TreeSize version-info masquerade, self-signed CN=Logitech cert, Sectigo timestamp counter-signature, dropped-by-gcleaner / mix8.file distribution)

  • fabricated-certificate-masquerade (sample 01372355, self-signed CN=Logitech with Sectigo timestamp, TreeDisk masquerade, gcleaner distribution pipeline)

  • fabricated-certificate-masquerade (sample 616740a4, self-signed CN=Equalizer APO with Sectigo timestamp, Proton Drive version-info masquerade)

  • msvc-section-reconstruction-packer (sample 0b839fc7, MSVC 14.0 PE32+ with empty on-disk sections and encrypted .9;t payload stub, triple RNG imports, SSPI+certificate APIs)

  • systemroot-poison-dll-hijack (sample f8ab87be57e4, MSVC 14.43 x64 console PE, May 2026, French-language logging, AWS API Gateway UNC C2, Edge process spawn with poisoned SystemRoot to hijack mswsock.dll load)

  • truncated-go-pe64 (sample 138b53c5, Go PE64+ x64 claiming 2.4 MB image but only 30 KB on disk; headers + partial .text survive, all other sections missing; source-side corruption confirmed by re-fetch from MalwareBazaar)

  • truncated-go-pe64 (sample 134a00b7, second confirmed sibling of the truncated Go PE64+ pattern; 262 KB on disk, identical section layout to 138b53c5 but different build ID lbdBnnyBahB8NB14vyKX/...; same structural truncation pattern, same upstream MalwareBazaar corruption)

  • msvc-pogo-reflective-loader-twin (sample 7e9bbc5c, fifteenth confirmed sibling, .text hash matches ae02bd22 and 21b12514, PE checksum 0x0002688E, individualized .data payload, dropped-by-phorpiex tag, no blackmatter label)

  • truncated-go-pe64 (sample 93857f30, third confirmed sibling of the truncated Go PE64+ pattern; 276 KB on disk, largest surviving stub in cluster, build ID _oMqNP3wSJk2Uh2mjhqz/..., claimed 2.1 MB SizeOfImage, identical section layout and null PE timestamp)

  • msvc-pogo-reflective-loader-twin (sample 877f1047, sixteenth confirmed sibling, .text hash divergent from ae02bd22/21b12514 group, PE checksum 0x00031DEB, individualized .data payload, dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/877f1047825cb5b73a4812279ac15e8987290c99a5d3a99473a9ec85066fabd6.html]

  • msvc-pogo-reflective-loader-twin (sample e67dbabcd, seventeenth confirmed sibling, .text hash matches majority group (ae02bd22/21b12514), PE checksum 0x32ac3, individualized .data payload, dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/e67dbabcd48b1294883b07d7724f416a77963c79aaf9d81bed9d7e2d0dcd9731.html]

  • msvc-pogo-reflective-loader-twin (sample 2ac8295381, eighteenth confirmed sibling, .text hash matches majority group (ae02bd22/21b12514/7e9bbc5c/e67dbabcd), PE checksum 0x63206d61, individualized .data payload, dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/2ac8295381ebafbe6399707f5435409e859c7c08bf51c666db4438ea5e4a4abb.html]

  • msvc-pogo-reflective-loader-twin (sample 89dc341bbd17, nineteenth confirmed sibling, .text hash matches majority group (ae02bd22/21b12514/7e9bbc5c/e67dbabcd/2ac8295381), PE checksum 0x297db, individualized .data payload (SHA-256 fb719c10...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/89dc341bbd176fbcee31f54884c132faf7c847838609f330249f634b99fd0a0c.html]

  • msvc-pogo-reflective-loader-twin (sample 8655b3b9b297, twentieth confirmed sibling, .text hash matches majority group (ae02bd22/21b12514/7e9bbc5c/e67dbabcd/2ac8295381/89dc341bbd), PE checksum 0x2ebd4, individualized .data payload (SHA-256 035c5d8e...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/8655b3b9b297ef153354a4f9778d7b621dd94adf4ca66d526cd7f0095b7fe5d4.html]

  • msvc-pogo-reflective-loader-twin (sample 91e39f6bb60a, twenty-first confirmed sibling, .text hash matches majority group (ae02bd22/21b12514/7e9bbc5c/e67dbabcd/2ac8295381/89dc341bbd/8655b3b9b2), PE checksum 0x33158, individualized .data payload (SHA-256 108818f3...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/91e39f6bb60a3860e6d1dc1fb711a8865281407614d5d106d03678c8723f2ddf.html]

  • msvc-pogo-reflective-loader-twin (sample 65844473d39b, twenty-second confirmed sibling, .text hash matches majority group (ae02bd22/21b12514/7e9bbc5c/e67dbabcd/2ac8295381/89dc341bbd/8655b3b9b2/91e39f6bb60a), PE checksum 0x2b4ee, individualized .data payload (SHA-256 cca2478b...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/65844473d39bb5b0cc86715b2da6da6fbb8dc12730d5a6caf972d132d74542f0.html]

  • msvc-pogo-reflective-loader-twin (sample 044539a2eacf, twenty-third confirmed sibling, .text hash matches majority group, PE checksum 0x2BA22, individualized .data payload (SHA-256 3279ce70...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/044539a2eacfd520e93aecc7f977b7ebea9d15c941a7101f5682ccb9fec68e1f.html]

||- msvc-pogo-reflective-loader-twin (sample f016df16d0f3, twenty-fourth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x306e9, individualized .data payload (SHA-256 e4c7fc94...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a.html] ||- msvc-pogo-reflective-loader-twin (sample a397bea4c70b, twenty-fifth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x31603, individualized .data payload (SHA-256 5271c3df...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/a397bea4c70bf3264348c88fca652fcbb2d421832672fa58a790af67bf419469.html] ||- msvc-pogo-reflective-loader-twin (sample 93da3f615d04, twenty-sixth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x2bfa9, individualized .data payload (SHA-256 7bc28648...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/93da3f615d041dc37a4b3db4a3d0c60bfd3c3fb1fc3ff4d5b764c646b629da7b.html] ||||- msvc-pogo-reflective-loader-twin (sample 0cd5240c6961, twenty-seventh confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x287d2, individualized .data payload (SHA-256 3c359767...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/0cd5240c696194cf2eb701cd4d4ca81e7f17612a4042ebb56959008d66537b4b.html] |||||- msvc-pogo-reflective-loader-twin (sample 92fc7f45d496, twenty-eighth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x27b0a, individualized .data payload (SHA-256 8f789bb9...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/92fc7f45d4968df95bc082220680c9ebd6a381a9467f77493878af031454d633.html] ||||||- msvc-pogo-reflective-loader-twin (sample c9417d468332, twenty-ninth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x2A989, individualized .data payload (SHA-256 1a1ee067...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/c9417d4683324c34c7b976395c01f79150a626966e27144244214423aa64ccde.html] ||||||||- msvc-pogo-reflective-loader-twin (sample 1985db0655bc, thirtieth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x2e30c, individualized .data payload (SHA-256 f6188dd1...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/1985db0655bca27343a13d8607904c53a292459083daa8c92ae2f71a5408b40a.html] ||||||||- msvc-pogo-reflective-loader-twin (sample 53e315669d72, thirty-first confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x257e3, individualized .data payload (SHA-256 4ec281cf...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/53e315669d72051a4add2e28938733dc116bb46fdc05dcda1958e7ea466812ed.html] |||||||||- msvc-pogo-reflective-loader-twin (sample 8796e69f738f, thirty-second confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x2E93A, individualized .data payload (SHA-256 580e7e7f...), dropped-by-phorpiex tag only, no blackmatter label) ^[/intel/analyses/8796e69f738fceb99fd177a5536dbccf5112ffa202a8b05be10ab45e600e289b.html] |||||||||||- msvc-pogo-reflective-loader-twin (sample 326536a0bcb9, thirty-third confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x2A4A9, individualized .data payload (SHA-256 376aa1c5...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/326536a0bcb9198049da10f4873446393c0f7ceb91098aecdd39a94f6d691112.html] |||||||||||| msvc-pogo-reflective-loader-twin (sample 06fe6a157bd3, thirty-fourth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x27367, individualized .data payload (SHA-256 aa830e60...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/06fe6a157bd3f67ae9f7cdf3478a0db670c2772b584cae5900d2473b6b109bb7.html] |||||||||||||| msvc-pogo-reflective-loader-twin (sample 34f9b16d363f, thirty-fifth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x31f6e, individualized .data payload (SHA-256 58c7f053...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/34f9b16d363f1bd44d912a62ee0745985ac696b6c4aaf4799a9b2b37d11720e8.html] |||||||||||||||| msvc-pogo-reflective-loader-twin (sample 80d36c0476b5, thirty-sixth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x29437, individualized .data payload (SHA-256 142e1ef8...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/80d36c0476b5de983271b65665bb6997eb58316bc3c151f04b045f45ef80784c.html] ||||||||||||||||||||||||| msvc-pogo-reflective-loader-twin (sample 2e3876a4a2e1, thirty-eighth confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x2FA78, individualized .data payload (SHA-256 795b3d29...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c.html] |||||||||||||||||||||||||||||||||||||||||||||||- msvc-pogo-reflective-loader-twin (sample d715b248f71c, forty-first confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x263B2, individualized .data payload (SHA-256 36c9cacc...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.html]

  • msvc-pogo-reflective-loader-twin (sample bc93fb67cf4d, forty-second confirmed sibling, .text hash matches majority group (cfbda2c4...), PE checksum 0x28702, individualized .data payload (SHA-256 8c53c2db...), dropped-by-phorpiex tag and blackmatter label) ^[/intel/analyses/bc93fb67cf4dba8c35e91b551ca3190db25ffa4a36f821bc5a6b900927470fb9.html]

Notes

Sample 9829594064f43ab1c956b329d897a1fab676742ea84f4da7673fde6cf0dc69c6 is the first entry. .NET 6.0 x64 self-contained binary, Noit.exe / FotFin namespace, WebSocket + Newtonsoft.Json C2 indicators, service persistence, heavy obfuscation. YARA hits DarkCrystal_RAT / Fynloski but toolchain mismatch suggests false positive. Static-only analysis.

Sample 708485983114d04a0e498dac08fb74e0c7033a6af892d807f939d9801a59348f (Re_HAWB_no._#SHKGA0004506.exe) — AutoIt-compiled dropper with two-stage payload chain. Stage 1: 14,336 bytes of x86 shellcode extracted from hex-split obfuscated $PBDWLMZ, executed via CallWindowProc with +9136 offset. Stage 2: shellcode reads %TEMP%\Sancha, XOR-decrypts with key 51AHC0R0YXO to yield a 288 KB PE32 (compiled Apr 2017, fully static, single .text section). Shellcode resolves APIs via PEB walking and CRC32 export hash. No C2 indicators in any layer. Static-only.

Sample 73d7c8e50ff4a34450c12fd28347b064d2d8147a92602c0ae101f5d9cbba639b (PO-0028201.PDF.exe) — Borland Delphi VCL PE32 (~1 MB) with purchase-order filename masquerade. No network C2, no credential APIs, no persistence, no anti-analysis. Import table dominated by VCL GUI runtime (user32, gdi32, comctl32). Three small RT_RCDATA blobs (max 3989 bytes) insufficient for a compressed payload. May be a benign application repackaged for social engineering, or a minimal stub with runtime-resolved threat logic. Static-only.

Sample 89dd9159d7d1186f24c977854f9c4b89f6c608e5b1c5848aca574918e2d24d70 — Python 3.13 embeddable runtime dropper. Four-layer obfuscation (getattr/__builtins__ indirection → Caesar-4 character shift → ~...~ delimiter strip → base64+zlib) decodes to a 683-byte ctypes loader. Loader VirtualAllocs RWX memory, copies the 2.4 MB companion file mbt3h2b4si into it, and jumps to offset 0x23CC4E (2347406) via EnumDesktopWindows callback injection. 93,778-byte encrypted shellcode region follows; no C2 strings, no VM/debug checks, no persistence. CAPE skipped as non-executable ZIP. Static-only. ^[/intel/analyses/89dd9159d7d1186f24c977854f9c4b89f6c608e5b1c5848aca574918e2d24d70.html]

Sample 60996777bf4f37e0eec2a99d450664278f103077f12a4b59178ff240ccb1b803 (1c67179f5185105599a045f76bdfcd56.exe) — MinGW-w64 PE32+ x64 stage-1 downloader with HTTPS C2 (77.110.123.164/api/stage1), AES-GCM payload decryption, HMAC-SHA256 integrity, and in-memory reflective PE loader. Promoted to own entity [unclassified-mingw64-https-stager](/intel/families/unclassified-mingw64-https-stager.html). Static-only (CAPE skipped — no Windows guest).

Sample bf109c1f20433e5b45a6c88d868d90a76ed7bbb13810047eace8f5c287820dbc (Contract_Draft.exe) — AutoIt-compiled dropper using autoit-hex-split-string-obfuscation with delimiter e6tcsd and callwindowproc-shellcode-injection. Drops 94,720-byte companion benting via FileInstall. Shellcode (14,336 bytes) is position-independent x86 with PEB-walking API resolution. XOR key for companion file differs from sibling 70848598 (51AHC0R0YXO does not decrypt benting), suggesting campaign rotation or independent actor using same builder. Static-only. ^[/intel/analyses/bf109c1f20433e5b45a6c88d868d90a76ed7bbb13810047eace8f5c287820dbc.html]

Sample 21b12514e8d728ac9c1381540af63aa2501ed5351e21bf9a90162233f9f85b2c — Third confirmed sibling in the MSVC 14.12 PE32 reflective-loader cluster (shared stub with 136b5750 and 3b42403b). Same PEB-walking API resolution, XOR-NOT alphabet cipher (0x10035fff), CPUID anti-VM, and LCG PRNG (0x19660d/0x3c6ef35f). Individualized encrypted .data payload and unique .text/.data section hashes (PE checksum 0x2F55C vs 0x2BC5A on 136b5750) confirm per-sample customization in a builder pipeline. Static-only. ^[/intel/analyses/21b12514e8d728ac9c1381540af63aa2501ed5351e21bf9a90162233f9f85b2c.html]

Sample 616740a4ece7a72d3dad48c314db9e1f5b2f1cf2916c3de2eb27a707e1cbdccd (PrimeHub.exe) — Themida-packed PE32+ x64 with Proton Drive version-info masquerade and self-signed Equalizer APO certificate. Entry point in .boot section is an LZ77 bit-stream decompressor that unpacks an encrypted payload at runtime. Only two imports exposed (GetModuleHandleA, TranslateMessage). Sectigo timestamp counter-signature present but does not make the cert trusted. No C2 strings recoverable from outer binary. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/616740a4ece7a72d3dad48c314db9e1f5b2f1cf2916c3de2eb27a707e1cbdccd.html]

Sample 0b839fc7c31163b315c74c53e3e86cb997397ba4ea756e839b4fd053fd947420 (new_agrm_19_may_timo.exe) — MSVC 14.0 PE32+ x64 GUI with a custom in-memory section-reconstruction packer. First seven PE sections are empty on disk (SizeOfRawData=0, entropy 0.0); the ~4.3 MB encrypted payload lives in the high-entropy .9;t section (entropy 7.949). Entry point at 0x1407CB826 falls inside .9;t, confirming the stub decrypts and rebuilds the original binary in memory before jumping to OEP. Imports IsDebuggerPresent, QueryPerformanceCounter, CreateProcessW, AdjustTokenPrivileges, CertAddCertificateContextToStore, AcceptSecurityContext, triple RNG (BCryptGenRandom, SystemFunction036, ProcessPrng), WSACleanup, and SHGetKnownFolderPath. No static C2 strings; new_agrm_ filename suggests agreement-document social-engineering lure. Fresh build (May 19 2026). Static-only. ^[/intel/analyses/0b839fc7c31163b315c74c53e3e86cb997397ba4ea756e839b4fd053fd947420.html]