unattributed

Umbrella entity for malware samples that do not yet map to a known family or cluster. This page collects singletons and low-confidence attributions until a sibling cluster emerges.

Capabilities

• dotnet-6-self-contained
• websocket-json-c2
• windows-service-persistence
• registry-query-modify
• process-create-terminate-suspend
• mutex-gating
• unmanaged-memory-manipulation
• dotnet-assembly-reflective-loading
• newtonsoft-json-serialization
• heavy-string-obfuscation
• autoit-hex-split-obfuscation
• callwindowproc-injection
• peb-walking-api-resolution
• reflective-pe-loader
• xor-encrypted-pe-staging
• python-embeddable-callback-injection
• enumdesktopwindows-rwx-callback
• multi-layer-python-obfuscation
• widgetservice-masquerade
• sleep-anti-emulation
• virtualalloc-rwx-memmove

Notes

Sample 9829594064f43ab1c956b329d897a1fab676742ea84f4da7673fde6cf0dc69c6 is the first entry. .NET 6.0 x64 self-contained binary, Noit.exe / FotFin namespace, WebSocket + Newtonsoft.Json C2 indicators, service persistence, heavy obfuscation. YARA hits DarkCrystal_RAT / Fynloski but toolchain mismatch suggests false positive. Static-only analysis.

Sample 708485983114d04a0e498dac08fb74e0c7033a6af892d807f939d9801a59348f (Re_HAWB_no._#SHKGA0004506.exe) — AutoIt-compiled dropper with two-stage payload chain. Stage 1: 14,336 bytes of x86 shellcode extracted from hex-split obfuscated $PBDWLMZ, executed via CallWindowProc with +9136 offset. Stage 2: shellcode reads %TEMP%\Sancha, XOR-decrypts with key 51AHC0R0YXO to yield a 288 KB PE32 (compiled Apr 2017, fully static, single .text section). Shellcode resolves APIs via PEB walking and CRC32 export hash. No C2 indicators in any layer. Static-only.

Sample 73d7c8e50ff4a34450c12fd28347b064d2d8147a92602c0ae101f5d9cbba639b (PO-0028201.PDF.exe) — Borland Delphi VCL PE32 (~1 MB) with purchase-order filename masquerade. No network C2, no credential APIs, no persistence, no anti-analysis. Import table dominated by VCL GUI runtime (user32, gdi32, comctl32). Three small RT_RCDATA blobs (max 3989 bytes) insufficient for a compressed payload. May be a benign application repackaged for social engineering, or a minimal stub with runtime-resolved threat logic. Static-only.

Sample 89dd9159d7d1186f24c977854f9c4b89f6c608e5b1c5848aca574918e2d24d70 — Python 3.13 embeddable runtime dropper. Four-layer obfuscation (getattr/__builtins__ indirection → Caesar-4 character shift → ~...~ delimiter strip → base64+zlib) decodes to a 683-byte ctypes loader. Loader VirtualAllocs RWX memory, copies the 2.4 MB companion file mbt3h2b4si into it, and jumps to offset 0x23CC4E (2347406) via EnumDesktopWindows callback injection. 93,778-byte encrypted shellcode region follows; no C2 strings, no VM/debug checks, no persistence. CAPE skipped as non-executable ZIP. Static-only. ^[/intel/analyses/89dd9159d7d1186f24c977854f9c4b89f6c608e5b1c5848aca574918e2d24d70.html]

Sample bf109c1f20433e5b45a6c88d868d90a76ed7bbb13810047eace8f5c287820dbc (Contract_Draft.exe) — AutoIt-compiled dropper using autoit-hex-split-string-obfuscation with delimiter e6tcsd and callwindowproc-shellcode-injection. Drops 94,720-byte companion benting via FileInstall. Shellcode (14,336 bytes) is position-independent x86 with PEB-walking API resolution. XOR key for companion file differs from sibling 70848598 (51AHC0R0YXO does not decrypt benting), suggesting campaign rotation or independent actor using same builder. Static-only. ^[/intel/analyses/bf109c1f20433e5b45a6c88d868d90a76ed7bbb13810047eace8f5c287820dbc.html]