#Loader

RE Oct 17, 2026 21 min read

Mops: a WebSocket loader and its stealer module 🐶

Mops is a modular x64 loader delivered by MixLoader and packed with the Golang packer Dormouse. It talks to its operator over a hand-rolled WebSocket channel, keeps a 64-domain DGA as fallback, and receives all of its capabilities as DLL modules mapped into a suspended cmd.exe. This post details the loader, its C2 protocol, and the two modules recovered from the live infrastructure: the Mops stealer (also seen branded Redhive) and an update/download-and-execute module.

RE Aug 1, 2024 20 min read

Latrodectus dropped by BR4 🕷️

This article details the last campaign involving Latrodectus malware that is dropped by BruteRatel, some YARA and hunting pivot are also provided.

RE Mar 29, 2023 5 min read

BumbleBee notes 🐝

BumbleBee is categorized as a Loader, the malware is used by Initial Access Brokers to gain access in targeted companies. This article aims to summarizing the different TTPs observed in campaigns distributing BumbleBee and provides a script to extract its configuration.