Malware

HelloExecutor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

If the command text did not match the above listed, the command is executed using cmd.exe.

T1059.010AutoHotKey & AutoITEvidence1

Detected TTPs: T1059 / T1218 — Proxy execution via AutoIt – “cmd” /c \$windir\autoit3.exe \$windir\data.dat

T1569.002Service ExecutionEvidence1

Detected TTPs: T1569.002 — System Services: Service Execution – “cmd” /c sc start UrBackupClientBackend

Persistence

2 techniques

T1112Modify RegistryEvidence1

Detected TTPs: T1112 — Modify Registry – reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32$selfname.dll

T1543.003Windows ServiceEvidence1

Detected TTPs: T1543.003 — Create or Modify System Process: Windows Service – sc stop AppMgmt – sc delete AppMgmt – sc create AppMgmt binpath= “system32\svchost.exe -k netsvcs”

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Он ищет процесс, имя которого содержит строку svchost, а командная строка — строку netsvcs. Если такой процесс найден, загрузчик внедряет себя в целевой процесс с помощью функций NtWriteVirtualMemory и NtCreateThreadEx.

T1543.003Windows ServiceEvidence1

Detected TTPs: T1543.003 — Create or Modify System Process: Windows Service – sc stop AppMgmt – sc delete AppMgmt – sc create AppMgmt binpath= “system32\svchost.exe -k netsvcs”

Stealth

4 techniques

T1036MasqueradingEvidence1

Detected TTPs: T1036 — Masquerading (service, description, and DLL masquerade as the legitimate Application Management)

T1055Process InjectionEvidence1

T1070.004File DeletionEvidence1

Detected TTPs: T1070.004 — Indicator Removal: File Deletion – “cmd” /c del $windir\amgmt.dll – “cmd” /c del $public\libraries\APN000B.txt

T1218System Binary Proxy ExecutionEvidence1

Detected TTPs: T1059 / T1218 — Proxy execution via AutoIt – “cmd” /c \$windir\autoit3.exe \$windir\data.dat

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Detected TTPs: T1112 — Modify Registry – reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32$selfname.dll

Discovery

9 techniques

T1007System Service DiscoveryEvidence1

Detected TTPs: T1007 — System Service Discovery – “cmd” /c sc query UrBackupClientBackend

T1016System Network Configuration DiscoveryEvidence2

Detected TTPs: T1016 — System Network Configuration Discovery – “cmd” /c arp -a – “cmd” /c routeprint

T1018Remote System DiscoveryEvidence1

Detected TTPs: T1018 — Remote System Discovery – “cmd” /c ping mail.ru -n 2

T1033System Owner/User DiscoveryEvidence1

Исполнялись следующие шелл-команды: query user ... dir c:\users\[username] ...

T1049System Network Connections DiscoveryEvidence1

Detected TTPs: T1049 — System Network Connections Discovery – “cmd” /c netstat -ano

T1057Process DiscoveryEvidence1

Detected TTPs: T1057 — Process Discovery – “cmd” /c tasklist

T1082System Information DiscoveryEvidence1

Detected TTPs: T1082 — System Information Discovery – `”cmd” /c systeminfo

T1083File and Directory DiscoveryEvidence2

Detected TTPs: T1083 — File and Directory Discovery – “cmd” /c dir temp*.tmp – “cmd” /c dir $temp\*.tmp – “cmd” /c dir amgmt*

T1087Account DiscoveryEvidence1

Исполнялись следующие шелл-команды: ... net user /do net group /do ...

Collection

2 techniques

T1005Data from Local SystemEvidence1

Detected TTPs: T1005 — Data from Local System – “cmd” /c type $temp\TS_E9E3.tmp – “cmd” /c type $temp\Acr6F3D.tmp

T1074.001Local Data StagingEvidence1

Detected TTPs: T1074.001 — Local Data Staging – “cmd” /c copy appdata\infotecs\*\APN000B.txt $public\libraries\

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelist ruNews

Jul 16, 2026

Кампания HelloNet: атаки через систему обновления ViPNet | Securelist

Backdoor implant used for reconnaissance and command execution on infected systems. It was observed running shell commands to enumerate users, network configuration, directories, and ViPNet-related paths.

securelistNews

Jul 16, 2026

HelloNet campaign: a threat via the ViPNet update system | Securelist

A backdoor used for reconnaissance and command execution on infected systems, including user, network, directory, and ViPNet-related discovery commands.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

HelloExecutor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

If the command text did not match the above listed, the command is executed using cmd.exe.

T1059.010AutoHotKey & AutoITEvidence1

Detected TTPs: T1059 / T1218 — Proxy execution via AutoIt – “cmd” /c \$windir\autoit3.exe \$windir\data.dat

T1569.002Service ExecutionEvidence1

Detected TTPs: T1569.002 — System Services: Service Execution – “cmd” /c sc start UrBackupClientBackend

Persistence

2 techniques

T1112Modify RegistryEvidence1

Detected TTPs: T1112 — Modify Registry – reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32$selfname.dll

T1543.003Windows ServiceEvidence1

Detected TTPs: T1543.003 — Create or Modify System Process: Windows Service – sc stop AppMgmt – sc delete AppMgmt – sc create AppMgmt binpath= “system32\svchost.exe -k netsvcs”

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

T1543.003Windows ServiceEvidence1

Detected TTPs: T1543.003 — Create or Modify System Process: Windows Service – sc stop AppMgmt – sc delete AppMgmt – sc create AppMgmt binpath= “system32\svchost.exe -k netsvcs”

Stealth

4 techniques

T1036MasqueradingEvidence1

Detected TTPs: T1036 — Masquerading (service, description, and DLL masquerade as the legitimate Application Management)

T1055Process InjectionEvidence1

T1070.004File DeletionEvidence1

Detected TTPs: T1070.004 — Indicator Removal: File Deletion – “cmd” /c del $windir\amgmt.dll – “cmd” /c del $public\libraries\APN000B.txt

T1218System Binary Proxy ExecutionEvidence1

Detected TTPs: T1059 / T1218 — Proxy execution via AutoIt – “cmd” /c \$windir\autoit3.exe \$windir\data.dat

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Detected TTPs: T1112 — Modify Registry – reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32$selfname.dll

Discovery

9 techniques

T1007System Service DiscoveryEvidence1

Detected TTPs: T1007 — System Service Discovery – “cmd” /c sc query UrBackupClientBackend

T1016System Network Configuration DiscoveryEvidence2

Detected TTPs: T1016 — System Network Configuration Discovery – “cmd” /c arp -a – “cmd” /c routeprint

T1018Remote System DiscoveryEvidence1

Detected TTPs: T1018 — Remote System Discovery – “cmd” /c ping mail.ru -n 2

T1033System Owner/User DiscoveryEvidence1

Исполнялись следующие шелл-команды: query user ... dir c:\users\[username] ...

T1049System Network Connections DiscoveryEvidence1

Detected TTPs: T1049 — System Network Connections Discovery – “cmd” /c netstat -ano

T1057Process DiscoveryEvidence1

Detected TTPs: T1057 — Process Discovery – “cmd” /c tasklist

T1082System Information DiscoveryEvidence1

Detected TTPs: T1082 — System Information Discovery – `”cmd” /c systeminfo

T1083File and Directory DiscoveryEvidence2

Detected TTPs: T1083 — File and Directory Discovery – “cmd” /c dir temp*.tmp – “cmd” /c dir $temp\*.tmp – “cmd” /c dir amgmt*

T1087Account DiscoveryEvidence1

Исполнялись следующие шелл-команды: ... net user /do net group /do ...

Collection

2 techniques

T1005Data from Local SystemEvidence1

Detected TTPs: T1005 — Data from Local System – “cmd” /c type $temp\TS_E9E3.tmp – “cmd” /c type $temp\Acr6F3D.tmp

T1074.001Local Data StagingEvidence1

Detected TTPs: T1074.001 — Local Data Staging – “cmd” /c copy appdata\infotecs\*\APN000B.txt $public\libraries\

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelist ruNews

Jul 16, 2026

Кампания HelloNet: атаки через систему обновления ViPNet | Securelist

securelistNews

Jul 16, 2026

HelloNet campaign: a threat via the ViPNet update system | Securelist

A backdoor used for reconnaissance and command execution on infected systems, including user, network, directory, and ViPNet-related discovery commands.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.