Malspam Uses Google DoubleClick Redirects to Deliver Fileless .NET Loader
Key Takeaways A new malspam campaign is leveraging Google DoubleClick redirects to distribute a sophisticated fileless .NET loader. The loader evades detection by injecting itself into legitimate...
Key Takeaways
- A new malspam campaign is leveraging Google DoubleClick redirects to distribute a sophisticated fileless .NET loader.
- The loader evades detection by injecting itself into legitimate Microsoft-signed processes and patching Windows’ native telemetry systems (AMSI and ETW).
- It establishes persistence using Windows registry Run keys and scheduled tasks, mimicking legitimate NVIDIA driver activity.
- Traditional antivirus solutions struggle to detect this threat due to its fileless nature, as the main payload never writes a malicious file to disk.
- Defenders should implement robust email authentication, attachment sandboxing, and user awareness training, alongside configuring script file types to open in Notepad by default.
Sophisticated Malspam Campaign Leverages Google DoubleClick for Fileless .NET Loader Delivery
A recently uncovered malspam campaign is employing an advanced technique to bypass traditional security measures, utilizing Google DoubleClick redirects to deliver a fileless .NET loader. This sophisticated loader operates without writing any recognizable malicious files to disk, making it exceptionally challenging for conventional antivirus software to detect, according to research from Huntress.
Table Of Content
The attack chain begins with malicious HTML attachments, often disguised as legitimate documents. When opened, these attachments initiate a series of redirects, including through Google DoubleClick, ultimately leading to the download of a ZIP archive containing a JavaScript loader. This loader then executes, injecting the fileless .NET payload directly into trusted Windows processes such as InstallUtil.exe or MSBuild.exe. By leveraging these Microsoft-signed executables, the malware operates under the guise of legitimate system activity, effectively masking its malicious intent from many security tools.
Defense Evasion and Persistence Techniques
Once the .NET loader is active within a trusted process, it immediately moves to neutralize Windows’ native security mechanisms. It achieves this by patching both the Anti-Malware Scan Interface (AMSI) and Event Tracing for Windows (ETW) at the memory level. AMSI and ETW are critical telemetry engines that Windows relies on to detect and report suspicious behaviors. By disabling these systems, the loader effectively blinds endpoint security solutions that depend on their output, preventing them from receiving crucial alerts about the ongoing compromise.
To ensure long-term access, the loader establishes persistence through common Windows mechanisms. It modifies Windows registry Run keys and creates scheduled tasks. To further blend into the system, it uses directory names that mimic legitimate NVIDIA driver installations, such as %USERPROFILE%AppDataLocalLowLocalLow WindowsProgram RulesProgram Rules NVIDEO. This tactic helps the malware evade detection by appearing as routine system files.
The loader maintains covert communication with two command-and-control (C2) servers over a non-standard port (7211) using AES encryption. This encrypted communication channel allows it to download additional malicious payloads or execute commands entirely from memory, further minimizing its footprint on the compromised system. The C2 communication utilizes a hardcoded AES password, P@55w0rd!, derived via PBKDF2, and a hardcoded IE8 User-Agent string (Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; WOW64; Trident/4.0...)) for payload retrieval.
Indicators of Compromise (IoCs)
| Type | Indicator | Description |
|---|---|---|
| File | Bestellung_2026.html | Malicious HTML attachment |
| Domain | fostercareintheus.optimizationprime[.]com | Redirector stage |
| Domain | bth.startthewave[.]org | Delivery kit host |
| URL | pengajian.muliastudy[.]com/images/edu/u.php | Serves the ZIP archive payload |
| File | A021185521S210008-11521.zip | Delivery ZIP archive served by malspam kit |
| File | A021185521S210008-11521.js | JavaScript loader |
| File | ktncm.js | JavaScript loader (relocated copy) |
| File | zkrbx.txt | Staging file |
| File | gglhn.txt | Staging file |
| File | nlbzl.ps1 | PowerShell dropper |
| File | shmvg_01.ps1 | PowerShell stager |
| Domain | andrefelipedonascime1778799406970.2241107.meusitehostgator[.]com[.]br | Serves 01.txt, 02.txt, 03.txt staging files |
| Path | %USERPROFILE%AppDataLocalLowLocalLow WindowsProgram RulesProgram Rules NVIDEO | Loader’s NVIDIA-themed staging directory |
| Domain | catalogo.castrouria[.]com | Serves bl.txt (packed loader) |
| SHA-256 | D5B7247C497788CF0031CEB06E3DF77A45FEF59F1E49633DC7159816D64759B5 | C2 certificate pin |
| SHA-256 | C61B1941CF756EB7551F7C661743802362728B785ADC22E860D269713DFB01A6 | C2 certificate pin |
| SHA-256 | C356AFF1A01C2B0DA472E584C8E3C8F875B9A24280435D42836A77B19F5A8C18 | C2 certificate pin |
| SHA-256 | F1C3EBE78BD8C38559BF3CFCC9A9FA37D221E31780774A3787E26160A61F5348 | C2 certificate pin |
| SHA-256 | E91FB249AA97BE5C7931E430781167EDFE7BA804720B5F643E6AB70B7E6E74DD | C2 certificate pin |
No Comment! Be the first one.