ETDownloader
ETDownloader is a C#/.NET first-stage downloader used in a March 2025 onward cyber-espionage campaign attributed to XDSpy. It is delivered through a multi-stage Windows LNK-based infection chain in which specially crafted shortcut files distributed inside ZIP archives ultimately launch a legitimate signed Microsoft binary, DeviceMetadataWizard.exe, to sideload a malicious d3d9.dll identified as ETDownloader. The malware has been associated with targeting governmental entities in Eastern Europe and Russia, with a confirmed victim in Belarus.
Observed delivery artifacts included ZIP archives such as dokazatelstva.zip and proyekt.zip containing malicious LNK lures, a second ZIP disguised with an .ini extension, DeviceMetadataWizard.exe, the malicious d3d9.dll, and decoy PDF files. The LNK execution chain used jsc.exe to compile JScript.NET into a temporary unzip utility and used forfiles.exe as part of execution. ETDownloader opens a decoy PDF by moving test.cfg into the user Documents folder and launching it via Explorer.
ETDownloader establishes persistence by creating startapp.bat in the user Startup folder at C:\Users<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, causing execution at logon. The batch file launches %AppData%\2A5S2FQJSU9B\YEZYZO107H.exe with the /startup argument. The malware attempts to download and execute an additional stage-2 payload, assessed with moderate to high confidence to be the Go-based XDigo implant. One reported hardcoded download URL was hxxps://vashazagruzka365[.]com/zagruzka/?pti=hlicbz&yay=G9CUTb3S8U4XHr8. The downloaded payload is decoded via base64, XORed with key 11PDL19R6LMRJPCQ, base64-decoded again, and saved as ytoqovbxx.exe under %AppData%\Roaming\2A5S2FQJSU9B.
The malware is obfuscated with ConfuserEx2 or a variant plus an additional XOR-based string encoding layer. Reported sample details include the sideloaded ETDownloader d3d9.dll with SHA-256 792c5a2628ec1be86e38b0a73a44c1a9247572453555e7996bb9d0a58e37b62b and reported compilation time 2025-03-05 13:18:57. High-confidence related artifacts in the infection chain include DeviceMetadataWizard.exe SHA-256 1793dae4d05cc7be9575f14ae7a73ffe3b8279a811c0db40f56f0e2c1ee8dd61. ETDownloader is consistently described as the stage-1 downloader in this XDSpy-linked intrusion set and as the component responsible for persistence and retrieval of the follow-on espionage implant.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
HarfangLab said it observed the threat actor leveraging a remote code execution flaw in Microsoft Windows that's triggered when processing specially crafted LNK files. The vulnerability (ZDI-CAN-25373) was publicly disclosed by Trend Micro earlier this March. | The DLL is a first-stage downloader dubbed ETDownloader that, in turn, is likely meant to deploy a data collection implant referred to as XDigo...
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The stage 1 downloader (ETDownloader) established persistence by creating `startapp.bat` in the Startup folder
The DLL is a first-stage downloader dubbed ETDownloader that, in turn, is likely meant to deploy a data collection implant referred to as XDigo...
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
5 techniques
Execution
The LNK file executed a complex Windows shell one-liner that: for /R "%USERPROFILE%" %f in (proyekt.zip) do ( echo [JavaScript .NET code] > %TEMP%\B5DUC80ULT7L.a %_jsc% /nologo /r:System.IO.Compression.FileSystem.dll /out:%TEMP%\unzip.exe %TEMP%\B5DUC80ULT7L.a %TEMP%\unzip.exe "%f" "%USERPROFILE%\L80OWGTGHWBX" start "" /MIN "%USERPROFILE%\L80OWGTGHWBX\YEZYZO107H.exe" )
“The LNK file triggers the execution of an intricate Windows shell command one-liner…”
“stores a JavaScript .NET code snippet … compiles the latter to an assembly … using … jsc.exe … runs … unzip.exe”
Persistence
2 techniques
Persistence
The primary persistence mechanism targets the Windows Startup folder, located at: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ The Windows Explorer shell automatically enumerates and executes all items within these directories during the user logon process.
T1547.009 Shortcut Modification is a technique in the MITRE ATT&CK framework under the Persistence tactic. It involves the modification of shortcuts (typically .lnk files) in Windows to achieve persistence by ensuring that malicious programs or scripts are executed whenever the user interacts with the shortcut.
Privilege Escalation
2 techniques
Privilege Escalation
The primary persistence mechanism targets the Windows Startup folder, located at: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ The Windows Explorer shell automatically enumerates and executes all items within these directories during the user logon process.
T1547.009 Shortcut Modification is a technique in the MITRE ATT&CK framework under the Persistence tactic. It involves the modification of shortcuts (typically .lnk files) in Windows to achieve persistence by ensuring that malicious programs or scripts are executed whenever the user interacts with the shortcut.
Stealth
4 techniques
Stealth
“downloaded payload is decoded with base64, then using XOR … then base64 again”
“another ZIP archive disguised with an .ini extension … a decoy PDF document, renamed as test.cfg”
Discovery
1 technique
Discovery
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stage 1 downloader used to establish persistence via the Windows Startup folder and continue the execution chain that led to DLL sideloading and deployment of a later implant.
Obfuscated C#/.NET DLL sideloaded via a legitimate Microsoft binary (DeviceMetadataWizard.exe) to establish persistence (Startup batch), display decoy documents, and download/decode/execute a next-stage payload from hardcoded staging URLs (base64 + XOR + base64).
First-stage downloader (rogue DLL sideloaded via a legitimate renamed executable) used to retrieve and deploy the XDigo data-collection implant.
Malicious DLL sideloaded via a crafted .LNK-triggered execution chain; contacts C2 to retrieve the main XDigo payload (acts as a downloader/loader stage).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.