SOCcare June 2026: previously unseen malware

It all started on a legitimate but compromised website – a Lithuanian clothing store. On which a convincing but fake message was placed – “let us know you’re human” – along with a simple “solution”: press Win + R, then Ctrl + V and Enter. An interesting detail is that the malicious message was loaded from the promo-chatgpt.com domain.

The trick is that the website’s code has already placed a malicious command onto the clipboard. The user thinks they are confirming their humanity, but in reality they launch the malware’s first command with their own hands. This technique, called ClickFix, is particularly unpleasant from a defensive standpoint: at the start there is often no download of malicious code at all; and the action is performed by the user themselves, so it looks like legitimate human activity. In the observed case, the executed command only created a scheduled task named “Enter”, which was already meant to download the next stage.

Once the scheduled task “Enter” ran, it downloaded and executed a script that saved two files into the user’s temporary directory (%TEMP%) – a launcher and an obfuscated PowerShell script – then added the registry “Run” key PersonalizedUpdates (so that it would run when the user logs in), deleted the scheduled task “Enter” itself (it had already done its job, so the trace is removed) and launched the obfuscated script.

It is precisely this obfuscated script that is the first real control component – a kind of “mini” PowerShell RAT. First it collected the system’s fingerprint – the username, the computer name and the unique system identifier stored in the registry (MachineGuid) – and encrypted it in several layers (XOR with a static, hardcoded key → string reversal → Base64). This fingerprint lets the operator identify each victim.

Then comes the most interesting part – how the script knows with which server to communicate. The C2 domain is not written into the script. Instead it is obtained dynamically from the blockchain – a technique called EtherHiding.

The essence of how it works is this: the operator “hides” their C2 domain in a smart contract on a public blockchain network (in this case – Polygon). The malicious code performs an eth_call type query to a specific contract (specifying its address and the function to be called), and the returned value is decoded into the actual C2 address. Unlike a domain or a server, a blockchain record cannot be taken down – it is immutable and uncensorable. And the queries travel to reputable public blockchain RPC nodes, which are rarely blocked in organizations. An important detail – eth_call is a read-only operation: it is executed locally on the blockchain node, no transaction is broadcast to the network, no “gas” fee is paid and no “on-chain” trace is left that could be linked to the victim. The malicious code simply reads the state of the contract – as if it were a value from a remote configuration file.

Having obtained the C2 address (3262d48df5d75e34[.]shop), the script began a periodic (every 20 seconds) beacon connection, sending the encrypted fingerprint in the Authorization header, thereby signaling that a new victim is active and awaiting commands.

From this C2 a single command was received: via Invoke-WebRequest download and run the next stage from the onemm[.]net domain (IP 37[.]27[.]52[.]152). The downloaded file was saved in the temporary directory – and from it begins the most interesting part of the chain.

The PowerShell script downloaded in the second stage begins the third part of the chain. First it checks whether Python is installed on the system, and if it does not find it – it unpacks a portable Python environment bundled within itself (gzip + Base64) together with the malicious code into a subfolder of the temporary directory and launches pythonw.exe (a Python environment without a pop-up window, the process runs in the background), passing it the malicious Python bytecode (.pyc) file, disguised under the innocent name LICENSE.txt.

Here lies another elegant trick: pythonw.exe is legitimately signed by “Python Software Foundation”, so signature-based protections do not block it. Only the .pyc file (LICENSE.txt) is malicious, while all the real activity happens under the name of a legitimate process –  the classic “bring your own interpreter” principle.

LICENSE.txt itself is heavily obfuscated: random function and variable names, XOR + Base64 encrypted strings, ”dead” code and control flow implemented through exceptions, all making analysis harder. Even before getting to work, it performs a sandbox check: it sleeps for 5-10min, then reads the USERNAME and COMPUTERNAME values and compares them against a “blacklist” of known analysis environments – for example, typical sandbox usernames (such as “JohnDoe”) or computer names (such as “DESKTOP-NAKFFMT”). Upon detecting such an indicator, the malware immediately terminates and thereby evades automated analysis systems. Only once it is convinced that it is running on a real machine does it continue its work.

The launched .pyc operates modularly – it is by now a full-fledged Python RAT that, according to C2 commands, downloads and executes individual modules (if needed it can relaunch itself as an x64 version too). First, system and network reconnaissance is performed – commands such as net session, cmd /c ver, ipconfig /all, net use and arp -a are run, and the installed antivirus programs are enumerated via the SecurityCenter2 WMI class. Next the bot establishes persistence via two more mechanisms (a registry “Run” key edgewebhelper_7565 and a logon script by adding the registry HKCU\Environment\UserInitMprLogonScript), thus adding two new ones to the earlier first-stage persistence.

Then data collection begins: the bot takes a screenshot, reads the clipboard contents and proceeds to steal data stored in the browser. To do this it forcibly closes the browsers and relaunches them with specific parameters that allow it to “unlock” the password and cookie databases. In this way browser data is stolen – not only passwords, but also session cookies, which make it possible to bypass multi-factor authentication (MFA), because once an active session is hijacked no separate login is needed.

The connection to the C2 again starts with EtherHiding – this time the C2 domain (aj3hf7uk3hh3yskr[.]com) is obtained from a second Polygon contract. The connection is by now more mature than the first stage’s “mini” RAT: JSON messages are encrypted with AES-256-GCM and sent over HTTPS less frequently (the default “beacon” interval is ~250 s), and the functionality is split across several endpoints – /b (beacon), /r (results), /l (logs), /mc/{name} (module download) and /s (interactive stream). The bot supports a rich set of commands: dynamically load, run and update modules, rotate encryption keys, and upon receiving a “kill” command – terminate and remove its traces. Failed transmissions go into a retry queue (up to 100 messages), so some of the data is not lost even when the connection is intermittent.

Finally the bot contacts yet another server (90happymoney[.]top) and downloads the last component – a browser extension, which turns the chain into full-fledged remote control within the browser itself.

The last component of the chain is downloaded from 90happymoney[.]top and installs itself as a Chrome extension (location %APPDATA%\MediaEngineOpen_6u6g8l, extension ID kkecmimnokipgkinknmmpjcbpldfdhfd). It consists of two obfuscated scripts that control two different layers – content.js and LensTestManager.ps1 – along with the control script background.js that connects them.

content.js runs in the context of every visited page. Its goal is to capture data while still in the browser. To do this it overrides three standard browser mechanisms: XMLHttpRequest.send(), window.fetch() and window.postMessage() – from that moment on all POST/PUT/PATCH traffic sent from the page passes through its filter. Besides traffic, content.js records keystrokes (keylogger functionality) and intercepts form submissions. It collects payment card data in several ways at once: it scans DOM elements, checks field names and autocomplete attributes, validates the numbers it finds with the Luhn algorithm and monitors the postMessage stream – in this way even data passed through iframes from payment processing services (“Stripe”, “Braintree”, “Spreedly”) is captured. All the collected information is passed to the background.js script.

System-level operations are carried out through a native messaging host. background.js sends commands via chrome.runtime.sendNativeMessage(“com.top.index”, …), and they are executed by LensTestManager.ps1, which is launched by TestPad.bat. LensTestManager.ps1 – a file of about 58 thousand lines, the bulk of which consists of junk, deceptive functions. The file header is forged so that the script would look like a legitimate tool: it declares itself to be “SessionManager v2.6.21 – Enterprise ResourcePool Module” (the author is listed as “Platform Engineering”). The real malicious code – one large obfuscated “PowerShell” string, hidden in the middle of the file. Before getting to work, it first “blinds” the defenses: it tries to disable AMSI, ETW and PowerShell script block logging, thereby depriving defenders of part of their visibility. Using the native messaging host, the operator can execute any “PowerShell” command.

background.js is the intermediate node between the extension and the operator. It gathers data from content.js and runs PowerShell commands via LensTestManager.ps1. Here too the C2 address is obtained via “EtherHiding” – this time from a third “Polygon” contract. Having connected to the C2 over WebSocket (wss://90happymoney[.]top:3001/ws), it maintains a persistent interactive connection. On first launch it automatically reads and sends to the C2 a screenshot, all browser cookies, browsing history, bookmarks, the list of installed extensions and the list of software present on the system.

At this stage the chain achieves its goal: content.js collects data in real time at the browser level, while LensTestManager.ps1 executes commands on the system itself. The victim is compromised simultaneously at both levels – both the browser and the system.