ANELLDR
- ID
- S9027
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 24 Apr 2026
ANELLDR, a loader that has been in use since at least 2018, was designed to decrypt and execute UPPERCUT in memory. ANELLDR can use anti-analysis techniques and is known to share code overlap with HiddenFace.[1][2]
Techniques used (8)
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1027.016 Junk Code Insertion
- T1083 File and Directory Discovery
- T1106 Native API
- T1140 Deobfuscate/Decode Files or Information
- T1574.001 DLL
- T1622 Debugger Evasion