TL;DR
- RoningLoader (Windows loader): Multi-stage loader from Dragon Breath for Gh0st RAT, distributed through fake NSIS installers disguised as Chrome/Teams, using a signed driver and WDAC/PPL to disable Defender. Detection is possible via the DLL launch and mutex.
- HoldingHands RAT: Winos 4.0 trojan with DLL loader, anti-VM checks, injection into taskhostw.exe, and C2 update via registry. Detection is possible via the HHClient registry and mutex.
- Snowlight: Dropper for fileless launch of VShell in memory, masquerading through kworker. Detection is possible via the launch of memfd:a (deleted) [kworker/0:2].
1) RoningLoader (Windows)
Sample: ANY.RUN
RoningLoader is a multi-stage malware loader used by the Dragon Breath group (APT-Q-27) for delivering the Gh0st RAT trojan. It is distributed through fake NSIS installers disguised as legitimate programs and uses a signed driver and changes to WDAC/PPL policies to disable security solutions and ensure unimpeded RAT operation.
How to detect: Detection is based on tracking characteristic commands and artifacts: launching "regsvr32.exe" in silent mode to load the malicious DLL, using "mklink /D" for a symbolic link to the Defender directory, mutex "Global\DHGGlobalMutex".
Key facts:
- Advanced bypass of protection through driver and system policies.
- Injection through thread pool, shellcode in disguised files.
- Keylogging and data collection from windows/clipboard.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-11-20 | News | 2025-09-11 | 45 | 2025-11-17 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
commandLine:"C:\\ProgramData\\Roning\\goldendays.dll" OR syncObjectName:"Global\\DHGGlobalMutex"
IOCs:
- MD5:
9726fb4b45a79b09d2599f2f27def5cf - MD5:
b8aca3e033bc47ed6f01d9e8775967ad - MD5:
d3797b2cdfbdbfcc4399ddfe15a152fc - SHA256 (1.bat):
395f835731d25803a791db984062dd5cfdcade6f95cc5d0f68d359af32f6258d - SHA256 (fhq.bat):
1c1528b546aa29be6614707cbe408cb4b46e8ed05bf3fe6b388b9f22a4ee37e2 - SHA256 (1.dll):
4d5beb8efd4ade583c8ff730609f142550e8ed14c251bae1097c35a756ed39e6 - SHA256 (goldendays.dll):
33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c - Domain:
qaqkongtiao[.]com
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1566.001 | Phishing: Spearphishing Attachment | Distribution through fake installers |
| T1574.002 | Hijack Execution Flow: DLL Side-Loading | Loading goldendays.dll and Wow64Log.dll |
| T1055.001 | Process Injection: Dynamic-link Library Injection | Injection through thread pool |
| T1068 | Exploitation for Privilege Escalation | Signed driver ollama.sys |
| T1540 | Abuse Elevation Control Mechanism | Modification of UAC settings |
| T1562.001 | Impair Defenses: Disable or Modify Tools | Disabling Defender through WDAC |
| T1027 | Obfuscated Files or Information | Shellcode in tp.png |
| T1056.001 | Input Capture: Keylogging | Keylogging |
| T1071.001 | Application Layer Protocol: Web Protocols | C2 via HTTP/HTTPS |
| T1543.003 | Create or Modify System Process: Windows Service | Service MicrosoftSoftware2ShadowCop4yProvider |
2) HoldingHands RAT (Windows)
Sample: ANY.RUN
HoldingHands is a RAT for Windows, used by the Silver Fox group (Winos 4.0). It provides remote control, data collection, command execution, implementation through DLL loader, privilege escalation, and hidden installation.
How to detect: Detection is based on the registry key '\HHClient" and the specific mutex "servciecasdkashjoii3245i2u5y".
Key facts:
- Multi-stage chain: exe → DLL loader → encrypted payload.
- Anti-VM (RAM, AV processes), injection into taskhostw.exe.
- C2 update via registry without reinstallation.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-11-25 | News | 2025-11-23 | 2 | 2025-08-09 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
registryKey:"HHClient" OR syncObjectName:"servciecasdkashjoii3245i2u5y"
IOCs:
- C2 IP:
23.249.29.117 - Registry key:
HKEY_CURRENT_USER\SOFTWARE\HHClient - Mutex:
Loader2353298680893435
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1568 | Dynamic Resolution | Updating C2 IP through registry |
| T1490 | Inhibit System Recovery | Task Scheduler for persistence |
| T1082 | System Information Discovery | Collection of system information |
| T1055 | Process Injection | Injection into taskhostw.exe |
| T1546.003 | Event Triggered Execution: Scheduled Task | Task Scheduler after reboot |
| T1497 | Virtualization/Sandbox Evasion | Anti-VM by RAM and processes |
| T1071.001 | Web Protocol: HTTP | C2 via HTTP |
| T1112 | Modify Registry | Writing AdrrStrChar to HHClient |
3) Snowlight (Linux)
Samples:
Snowlight is a dropper in a bash-script or executable file format, designed for delivering and launching fileless payloads, such as VShell. One of its key techniques is creating and launching VShell through memfd_create (syscall 0x13f) and fexecve, which minimizes payloads hitting the disk.
How to detect: Signature for unusual launch "memfd:a (deleted)[kworker/0:2]".
Key facts:
- Fileless execution of VShell in memory.
- Uses curl to download the second stage loader.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-11-25 | News | 2025-06-10 | 138 | 2025-11-18 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
commandLine:"[kworker/0:2]" and imagePath:"memfd:a (deleted)"
IOCs:
- MD5:
2d235a81785d2fe74084c4c7b1d30e05 - MD5:
4a01475ae47d195c9b7f41c19675936a - commandLine:
[kworker/0:2] - C2 IP:
134.122.140.185 - C2 IP:
103.30.76.206
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1003.008 | OS Credential Dumping: /etc/passwd and /etc/shadow | Reading passwd file |
| T1218 | System Binary Proxy Execution | Launching file through nohup |
| T1105 | Ingress Tool Transfer | Curl for downloading the second stage loader |
| T1082 | System Information Discovery | Collection of system information |
| T1070.004 | File Deletion | Deletion of temporary file |
Conclusion
1) APT groups are enhancing loaders: RoningLoader demonstrates combining NSIS installers with system exploits to neutralize protection.
2) RATs are evolving towards dynamic C2: HoldingHands from Winos 4.0 allows updating infrastructure without reinstallation.
3) Linux threats are shifting to fileless execution: Snowlight with memfd_create emphasizes the shift to memory-only attacks, complicating detection on servers.