TL;DR
- GuLoader (Windows downloader): A stealthy malware downloader using heavily obfuscated shellcode, process injection, and cloud storage to deliver various malicious payloads, such as RATs and infostealers. It is distributed via lures and can be detected by obfuscated PowerShell commands.
- Albiriox (Android trojan): A family of Android banking trojans distributed via the MaaS model, with a VNC module for remote control and overlays to bypass protection. It targets over 400 financial applications and can be detected by the DeviceIDPrefs.xml file and C2 IPs.
- OctoRAT (Windows RAT): A full-featured .NET-based RAT via the MaaS model with remote control capabilities, credential theft, crypto wallet collection, and proxy. It injects into fodhelper.exe and can be detected by the OctoRAT_Client_Mutex mutex.
1) GuLoader (Windows)
Sample: ANY.RUN
GuLoader is a downloader used by attackers to distribute malware. It acts as the first stage of the infection chain and is most often delivered via lures.
How to detect: Detected by monitoring anomalous obfuscation of PowerShell commands.
Key facts:
- A stealthy malware downloader using heavily obfuscated/encrypted shellcode.
- Process injection and cloud storage for delivering various malicious payloads, such as RATs and infostealers.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-12-15 | TI | 2025-12-16 | 0 | 2025-12-15 |
Using the following TI Lookup query, we can search recent public sandbox analyses and identify this malicious activity.
TI Lookup:
commandLine:"powershell*=Get-Date"
IOCs:
- SHA256:
4e7d45b7b9faf613eb495235f914fbaf0fc172f746b6084c09bddb55eeed958e - IP:
81.180.138.230
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Uses obfuscated powershell to deliver malware |
| T1047 | Windows Management Instrumentation | Accesses local storage devices (Win32_LogicalDisk) |
| T1012 | Query Registry | Checks proxy server information |
| T1057 | Process Discovery | Gets information on the list of running processes |
2) Albiriox (Android)
Sample: ANY.RUN
Albiriox is a family of Android banking trojans distributed via the Malware-as-a-Service (MaaS) model. The malware is focused on "on-device" fraud and provides remote interactive control over the smartphone through a built-in VNC module, allowing screen streaming and performing actions on behalf of the user. The main functionality is aimed at bypassing the protection mechanisms of banking and payment applications by performing operations directly in a legitimate user session. The malware configuration includes a wide list of targets — over 400 banking, payment, and crypto applications, indicating a global scale of attacks. Distribution is carried out through social engineering: SMS campaigns and phishing sites imitating Google Play. The primary APK acts as a dropper and, after obtaining permission to install from unknown sources, downloads the main malicious component from remote infrastructure.
How to detect: Detection of Albiriox is based on identifying characteristic configuration artifacts used by the malware to identify the infected device. A key indicator is access to the file shared_prefs/DeviceIDPrefs.xml, which stores a unique device identifier (HWID) used for registration on the management server. Analysis of the file's content allows detecting the presence of a specific device_hwid parameter, indicating activity of this malware family. Detection occurs at an early stage of analysis, without the need for network indicators or behavioral anomalies, allowing Albiriox to be detected even when using obfuscation and modified management infrastructure.
Key facts:
- Uses two key mechanisms: remote access module (AcVNC) and overlay system.
- VNC module provides full interactive control over the device and screen streaming.
- Overlays are used to hide activity, including fake system update screen and black screen.
- The list of targets is hard-coded in the internal configuration and includes over 400 financial and payment applications.
- Management is carried out through a set of commands for emulating user actions.
- Communication with the management server is implemented via an unencrypted TCP channel with JSON message exchange.
- Obfuscation and packing are used to increase resistance to analysis.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-12-08 | News | 2025-12-16 | 6 | 2025-11-30 |
Using the following TI Lookup query, we can search recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"\\data\\data\\/*\\shared_prefs\\DeviceIDPrefs.xml" OR destinationIP:"185.208.156.239" OR destinationIP:"194.32.79.94"
IOCs:
- SHA256:
070640095c935c245f960e4e2e3e93720dd57465c81fa9c72426ee008c627bf3 - SHA256:
5e14181839816bbb4b55badc91f29d382e8d6f603eec2ed8f8b731c35def6b59 - SHA256:
3269a0116ce0915afdd32e8d87b05ae9f5c00fcf0a6729add39a6a87aaf30089 - SHA256:
a0c9d6eb1932c96a11301c00cf96ce9767fb11401e090f215f972df06b09a878 - IP:
194.32.79.94 - IP:
185.208.156.239
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1204.002 | User Execution: Malicious File | Distribution is carried out through fake applications (for example, Penny Market); the user manually downloads and installs the APK from a fake Google Play page. |
| T1105 | Ingress Tool Transfer | The dropper, after obtaining permissions, downloads the main malicious APK via an unencrypted TCP channel from the attackers' servers. |
| T1021.005 | Remote Services: VNC | The main functionality is implemented through the VNC module (AcVNC), which allows the operator to see the screen and control the device in real time. |
| T1417.002 | GUI Input Capture (Overlay) | The trojan implements several types of overlays — system update, black screen, and universal forms — for stealing credentials and hiding operations. |
| T1201 | Abuse Accessibility Features | Albiriox abuses Accessibility services for automating clicks, reading screen content, and bypassing the FLAG_SECURE flag of banking applications. |
| T1027 | Obfuscated/Encrypted Execution | To bypass detection, the JSONPacker packer and Golden Crypt cryptor are used, allowing the generation of FUD variants of APK and complicating static analysis. |
| T1071 | Application Layer Protocol | Communication with C2 is built on a custom unencrypted TCP protocol with JSON commands and ping/pong exchange, ensuring a persistent connection. |
| T1090 | Proxy | In RAT mode, the attacker uses the infected device as a proxy for conducting transactions and bypassing anti-fraud systems, acting directly in the victim's banking applications. |
| T1564.003 | Hide Artifacts: File System Permissions Modification | During installation, Albiriox requests the SYSTEM_ALERT_WINDOW privilege and permission to install from unknown sources, allowing it to display windows over the interface and download additional APKs without notifying the user. |
3) OctoRAT (Windows)
Sample: ANY.RUN
OctoRAT is a full-featured .NET-based RAT operating via the Malware-as-a-Service model. It provides extensive post-exploitation capabilities, including remote desktop control, credential theft, crypto wallet collection, system surveillance, and proxy functionality. In this case, OctoRAT is executed after decryption and hollowing of the process and injected into fodhelper.exe to gain elevated privileges.
How to detect: Identified by the mutex OctoRAT_Client_Mutex_{GUID} and YARA rule.
Key facts:
- Full remote desktop control with mouse and keyboard.
- File upload, download, and execution.
- Registry and service manipulation.
- Disabling firewall and UAC.
- Self-update and self-deletion function.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-12-12 | TI | 2025-12-12 | 20 | 2025-11-30 |
Using the following TI Lookup query, we can search recent public sandbox analyses and identify this malicious activity.
TI Lookup:
syncObjectName:"OctoRAT_Client_Mutex_"
IOCs:
- SHA256:
a7416b07a28c4f51dc1848828c7e2caeb2e5d8296ff29d147684d9de499a4f13 - Mutex:
OctoRAT_Client_Mutex_{B4E5F6A7-8C9D-0E1F-2A3B-4C5D6E7F8A9B} - Mutex:
Global\OctoRAT_Client_Mutex_file - Registry name:
OctoRAT_Client - C2:
server747.mentality.cloud
Yara
rule OctoRAT {
meta:
description = "Detects OctoRAT - Advanced .NET RAT with remote desktop/HVNC, credential/wallet stealing, browser data extraction, keylogging, clipboard monitoring, network analysis, UAC bypass (FodHelper), on-device fraud, and harassment features. Delivered via multi-stage infection chains."
date = "2025-12-09"
author = "ANY.RUN:A.Adhikara"
threat = "octorat"
tags = "octorat, rat"
strings:
$x1 = "OctoRAT" fullword wide
$x2 = /OctoRAT_(Service|Client)/ fullword wide
$f1 = "fun_message" fullword wide
$f2 = "fun_play_sound" fullword wide
$f3 = "fun_swap_mouse" fullword wide
$f4 = "fun_flip_screen" fullword wide
$f5 = "fun_lock_screen" fullword wide
$f6 = "fun_block_input" fullword wide
$f7 = "fun_open_cd_tray" fullword wide
$f8 = "fun_hide_taskbar" fullword wide
$f9 = "fun_minimize_all" fullword wide
$f10 = "fun_shake_windows" fullword wide
$f11 = "fun_open_notepad" fullword wide
$f12 = "fun_open_website" fullword wide
$f13 = "fun_change_wallpaper" fullword wide
$f14 = "fun_spam_disk" fullword wide
$f15 = "update_client" fullword wide
$f16 = "uninstall_client" fullword wide
$f17 = "disable_uac" fullword wide
$f18 = "disable_firewall" fullword wide
$f19 = "check_python" fullword wide
$f20 = "get_startup" fullword wide
$f21 = "grab_wallets" fullword wide
$f22 = "get_browser_history" fullword wide
$f23 = "start_clipboard_monitor" fullword wide
$f24 = "upload_file_chunk" fullword wide
$f25 = "rd_mouse_move" fullword wide
$f26 = "rd_mouse_up" fullword wide
$s1 = "Starting connection to {0}:{1}" fullword wide
$s2 = "Step 1: Disconnecting any existing connection..." fullword wide
$s3 = "Step 1: Disconnect completed" fullword wide
$s4 = "Step 2: Creating TcpClient..." fullword wide
$s5 = "Step 2: TcpClient created" fullword wide
$s6 = "Step 3: Configuring socket options..." fullword wide
$s7 = "Step 3: Socket configured (ReceiveTimeout={0}, SendTimeout={1})" fullword wide
$s8 = "Step 4: Setting advanced socket options..." fullword wide
$s9 = "Step 4: Advanced socket options set" fullword wide
$s10 = "WARNING: client.Client is null, cannot set socket options" fullword wide
$s11 = "Step 5: Starting async connection..." fullword wide
$s12 = "Step 5: Waiting for connection or timeout..." fullword wide
$s13 = "ERROR: Connection timeout after 30 seconds" fullword wide
$s14 = "Step 6: Checking connection result..." fullword wide
$s15 = "Step 6: Connection task completed successfully" fullword wide
$s16 = "ERROR Step 6: Connection failed:" fullword wide
$s17 = "Exception type:" fullword wide
$s18 = "WARNING: Not connected, cannot send packet type='" fullword wide
$s19 = "WARNING: Packet type is null or empty" fullword wide
$s20 = "WARNING: Stream is null or not connected, cannot send type='" fullword wide
$s21 = "Entering lock (streamLock)..." fullword wide
$s22 = "Lock acquired" fullword wide
$s23 = "stream is null: {0}" fullword wide
$s24 = "connected: {0}" fullword wide
$s25 = "ERROR: stream is null or not connected" fullword wide
$s26 = "Step 1: Caching stream reference..." fullword wide
$s27 = "ERROR Step 1: Stream is null or not connected after cache" fullword wide
$s28 = "Step 1: Stream cached, CanWrite={0}" fullword wide
$s29 = "Step 2: Preparing file header..." fullword wide
$s30 = "Step 2: Header prepared (filename length={0}, file size={1})" fullword wide
$s31 = "Step 3: Writing file header..." fullword wide
$s32 = "Step 3a: Magic written" fullword wide
$s33 = "Step 3: Reading packet data..." fullword wide
$s34 = "ERROR Step 3: Stream is null at {0}/{1} bytes" fullword wide
$s35 = "ERROR Step 3: Read returned 0 bytes at {0}/{1} bytes" fullword wide
$s36 = "Step 3: Packet data read successfully ({0} bytes)" fullword wide
$s37 = "Step 4: Parsing packet JSON..." fullword wide
$s38 = "Step 4: Packet parsed: type='" fullword wide
$s39 = "SUCCESS: Packet received and parsed" fullword wide
$s40 = "CRITICAL ERROR:" fullword wide
$s41 = "=== RMM Client Starting ===" fullword wide
$s42 = "Not running as admin, attempting FodHelper UAC bypass..." fullword wide
$s43 = "UAC bypass successful, process will restart elevated" fullword wide
$s44 = "FodHelper failed, trying runas..." fullword wide
condition:
uint16(0) == 0x5A4D and
(
(
any of ($x*) and
(
(5 of ($f*) and 10 of ($s*)) or
(all of ($f*)) or
(all of ($s*))
)
)
or
(
(
(20 of ($f*) and 10 of ($s*)) or
(10 of ($f*) and 20 of ($s*))
)
)
)
}
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1055 | Process Injection | Payload is injected and executed inside fodhelper.exe after decryption and hollowing. |
| T1548.002 | Abuse Elevation Control Mechanism: Bypass UAC | Uses FodHelper UAC bypass by hijacking ms-settings registry keys to gain admin privileges silently. |
| T1053.005 | Scheduled Task | Creates a scheduled task named WindowsUpdate running every minute for persistence. |
| T1555 | Credentials from Password Stores | Extracts browser passwords, cookies, autofill data from SQLite databases of Chrome, Edge, Firefox. |
| T1090 | Proxy | Starts a SOCKS reverse proxy to route attacker traffic through the infected host. |
| T1112 | Modify Registry | Writes and deletes registry keys for UAC bypass and security feature manipulation. |
| T1071.001 | Web Protocols | Communicates with C2 over HTTP using JSON packets with system and victim metadata. |
Conclusion
1) Malware downloaders rely on obfuscation: GuLoader uses strong PowerShell obfuscation and injection to deliver diverse payloads.
2) Mobile trojans use MaaS with VNC: Albiriox with remote control and overlays targets the global financial sector, bypassing protection through social engineering.
3) .NET RATs apply post-exploitation: OctoRAT with injection into system processes and proxy functions provides multifunctional access for long-term control.