ANELLDR — Malware Profile

ANELLDR, a loader that has been in use since at least 2018, was designed to decrypt and execute UPPERCUT in memory. ANELLDR can use anti-analysis techniques and is known to share code overlap with HiddenFace.

MITRE ATT&CK techniques (8)

• T1027 Obfuscated Files or Information
• T1027.013 Encrypted/Encoded File
• T1027.016 Junk Code Insertion
• T1083 File and Directory Discovery
• T1106 Native API
• T1140 Deobfuscate/Decode Files or Information
• T1574.001 DLL
• T1622 Debugger Evasion

Read the full analysis on IntelFusions