MITRE ATT&CKsoftware (malware)
S9027 ANELLDR
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2026-04-19
Description
ANELLDR, a loader that has been in use since at least 2018, was designed to decrypt and execute UPPERCUT in memory. ANELLDR can use anti-analysis techniques and is known to share code overlap with HiddenFace.
Related
Uses · MITRE ATT&CK (8)
- T1027.016 Junk Code Insertion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1622 Debugger Evasion technique
- T1574.001 DLL sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1027 Obfuscated Files or Information technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- C0060 Operation AkaiRyū campaign