Skip to content
MalwareWiki

Loader

GRAPELOADER

According to Checkpoint Research, GRAPELOADER is a newly observed initial-stage tool used for fingerprinting, persistence, and payload delivery.

GRAPELOADER is a Windows loader operated by APT29.

Background

Checkpoint Research reports GRAPELOADER as a recently spotted first-stage tool handling fingerprinting, persistence, and payload delivery. Although their functions differ, it overlaps with WINELOADER in code structure, obfuscation, and string decryption. GRAPELOADER improves upon WINELOADER's anti-analysis tricks and adds more sophisticated stealth techniques.

Source: Malpedia (Fraunhofer FKIE).