Skip to content
MalwareWiki

Loader

GalaxyLoader

GalaxyLoader is a simple .NET loader. Its name stems from the .pdb and the function naming.

GalaxyLoader is a Windows loader.

Background

GalaxyLoader is a basic .NET loader, named after clues found in its .pdb path and function names.

It appears to rely on iplogger.com for tracking and uses WMI to query the system via:

  • IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
  • IWbemServices::ExecQuery - select * from Win32_VideoController
  • IWbemServices::ExecQuery - SELECT * FROM AntivirusProduct

Source: Malpedia (Fraunhofer FKIE).