ANELLDR, a loader that has been in use since at least 2018, was designed to decrypt and execute UPPERCUT in memory. ANELLDR can use anti-analysis techniques and is known to share code overlap with HiddenFace.
Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.
Upgrade to Premium