Overview

overview

9

Static

static

1

URLScan

urlscan

1

http://adventistai.lt

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    http://adventistai.lt
  • Sample260808-dyvsnsgq91
Score
9/10
discovery

Malware Config

Targets

    • Target
      http://adventistai.lt
    Score
    9/10
    discovery

    • .NET loader stage by imphash + section/import shape

    • CLR-hosted .NET infostealer assembly: GDI screen capture + AES CryptoStream + raw TcpClient exfil +

    • CLR-hosted .NET infostealer: reflective assembly + browser cred theft + AES socket exfil

    • CLR-hosting MZER loader (student_s.bin, /std/ branch); boots .NET/Donut infostealer via mscoree.

    • CLR-hosting MZER loader stage (my_sss.bin / student_s.bin), ~276KB

    • ClickFix v8 — MZER custom loader stub with x64 PIC bootstrapper

    • Complete MZER GetPC stub as a code-anchor (immediate wildcarded)

    • Donut .NET loader by imphash — stable across all waves/branches despite per-lure SHA-256 churn

    • Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio

    • Fires on any WP-002 chain component

    • Injected CLR-hosted .NET infostealer (memory scan): AES-over-raw-TCP + screen capture + WMI recon

    • MZER polyglot header + complete GetPC self-locating x64 stub (branch immediate wildcarded)

    • MZER polyglot header: position-independent Donut shellcode masquerading as PE (cross-version cluster

    • MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub

    • MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub (offset 0). Durable c

    • MZER-polyglot Donut loader family: header + GetPC bootstrap prologue at offset 0

    • NEW in V12.1: native MinGW-w64/GCC-15 WinHTTP downloader stage fetching enterprise/student_s.bin

    • Native PE32+ loader: process-enum + remote-thread injection + WinHTTP stage fetch

    • Network IOCs for the WP-002 stage host and C2 gate

    • V12.1 infra: new stage-2 IP, recycled V11 C2 domain, TDS, lure host, EtherHiding contract

    • WinHTTP downloader by imphash — durable cross-wave-cluster pivot

    • WinHTTP downloader/injector MZER stage (std_enterprise ~50KB).

    • WinHTTP downloader/injector MZER stage, ~50KB

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Downloads MZ/PE file

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks