Malware hunting & reverse engineering notes Loaders, crypters, RATs, Windows internals and the tooling to take them apart.

Tags

#C2

1 article · feed for this tag

RE 21 min read

Mops: a WebSocket loader and its stealer module 🐶

Mops is a modular x64 loader delivered by MixLoader and packed with the Golang packer Dormouse. It talks to its operator over a hand-rolled WebSocket channel, keeps a 64-domain DGA as fallback, and receives all of its capabilities as DLL modules mapped into a suspended cmd.exe. This post details the loader, its C2 protocol, and the two modules recovered from the live infrastructure: the Mops stealer (also seen branded Redhive) and an update/download-and-execute module.