MLTBackdoor Uses ClickFix Lures and DLL Sideloading to Evade Analysis

Researchers detailed MLTBackdoor, a newly identified backdoor assessed as likely linked to a ransomware-related threat actor, delivered through a multi-stage ClickFix social-engineering chain. Victims are lured from an automotive-themed webpage into running commands that fetch a disguised archive from a DGA-generated domain, decrypt an RC4-protected payload, and install the malware through DLL sideloading with the signed Microsoft Defender binary mpextms.exe. Zscaler said one generated domain, hrs2y15sungu[.]com, was used for both payload delivery and command-and-control traffic.

The malware is built to resist detection and analysis, using heavy LLVM-based obfuscation, mixed boolean-arithmetic, control-flow flattening, stack-built strings, API hashing, and Hell's Gate-style indirect system calls; researchers said roughly 95% of the code consists of junk mathematical operations. Rather than exiting when it detects analysis environments, MLTBackdoor performs 10 anti-analysis checks for virtualization, sandboxing, debugging, and limited system resources, then reports the resulting bitmask to its operators. It communicates over TLS on port 443 using a custom binary protocol at /api/v1/telemetry with a Microsoft-Delivery-Optimization/10.1 user agent, derives AES-256-GCM session keys via ECDH on NIST P-256, and includes file-management features plus a Beacon Object File loader that expands post-exploitation capability in memory.