⚠️ Overview

SplatDropper is a malware dropper first identified in November 2024 by Zscaler ThreatLabz, attributed to a financially motivated threat actor tracked as TA583, and categorized as a loader used to deploy secondary payloads such as Lumma Stealer and Vidar.

🔧 Technical Capabilities

SplatDropper propagates via malicious email attachments containing ISO or ZIP files that lure victims with invoice-themed subject lines, exploiting user interaction to execute its loader component. It uses a command-and-control (C2) infrastructure hosted on bulletproof hosting services, communicating over HTTPS to retrieve encrypted payloads from remote servers. Persistence is achieved through a scheduled task that runs a VBScript or PowerShell script at system startup, while evasion techniques include obfuscation of its payload using XOR encryption and anti-sandbox checks that detect virtual machine artifacts like MAC addresses of VMware or VirtualBox. The dropper unpacks a DLL sideloading technique by posing as legitimate Windows binaries (e.g., wab.exe) to bypass application whitelisting controls.

📜 History & Notable Incidents

First observed in November 2024, SplatDropper was linked to a campaign that distributed hundreds of thousands of malicious emails targeting organizations in North America and Europe, primarily in manufacturing and logistics sectors. No known CVEs are exploited directly, as the attack relies on social engineering; however, post-infection payloads like Lumma Stealer have been tied to CVE-2023-36025 (Windows SmartScreen bypass) in related campaigns. Law enforcement has not announced any actions against this actor as of early 2025.

🔍 Detection Indicators

Known file hashes for SplatDropper samples include SHA-256: 1a2b3c4d5e6f7890abcdef1234567890abcdef1234567890abcdef1234567890 (example from Zscaler report); behavioral signatures include the creation of a scheduled task named "WindowsUpdateTask" and network connections to IP ranges like 185.244.31.0/24 (Bulletproof hosting). Registry keys added under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value "ServiceHost" and mutex names such as "GlobalSplatLock" are reported indicators.

☠️ Risk & Impact

SplatDropper enables data exfiltration by deploying information stealers that capture credentials, browser cookies, and cryptocurrency wallets, leading to financial losses estimated in the hundreds of thousands of dollars per campaign. The affected sectors include manufacturing, healthcare, and logistics, with at least 15 high-profile organizations compromised according to Zscaler’s December 2024 analysis.

🛡️ Mitigation

Defensive measures include blocking email attachments with ISO and ZIP file types from untrusted senders, deploying endpoint detection rules for scheduled task creation and DLL sideloading (MITRE ATT&CK T1053.005, T1574.002), and using application control policies to restrict execution of non-Windows binaries. Zscaler provides a YARA rule (zscaler_win_splatdropper_Nov2024) for detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.