A memory loader tool called Ezuri is used by TeamTNT and other threat actors to hide their malware from detection. It is designed to work on Linux hosts as opposed to Windows. The tool is open source and can be used by attackers to execute malware in memory instead of writing the payload to a disk. When an attacker runs the Ezuri tool, they provide the path to the file they want to be encrypted, the destination process name, and, optionally, an AES key for encryption. The generated executable can then be run on a victim host in order to infect them with the attacker’s malware. This is done by decrypting the embedded payload and using “memfd create” to create the target process. Ezuri loader leads to a lower detection rate by AV vendors. TeamTNT used the Ezuri loader to install their cryptomining and stealer malware. Additionally, the researchers were able to identify Gafgyt samples packed using Ezuri.