malware

ANELLDR

S9027 · ATT&CK v19.2

Platforms

Windows

Tracked actors

Description

[ANELLDR](https://attack.mitre.org/software/S9027), a loader that has been in use since at least 2018, was designed to decrypt and execute [UPPERCUT](https://attack.mitre.org/software/S0275) in memory. [ANELLDR](https://attack.mitre.org/software/S9027) can use anti-analysis techniques and is known to share code overlap with [HiddenFace](https://attack.mitre.org/software/S9023).(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)

Actors that use this

0 tracked actors

No tracked actor uses this yet

Not linked to any of our tracked MENA actors in actor_software — still browsable via the ATT&CK dictionary above.