›
BLOG ◆ AUG 28, 2026

The Video That Plays You: Fake MP4 File Carries Malicious Payload

C2, Research, Threat Intelligence

Executive Summary

  • This chain leverages a Powershell loader to deliver a payload in a fake MP4 (video file).
  • The fake MP4 contains 6.5 MB of encrypted NetSupport client data (both executable and configuration) in an ISO Base Media File Format (uuid) extension box. 
  • Basic file-type checks identify the file as MP4 file type, but it is not a playable video.
  • The same Cloudflare-fronted host serves both the initial PowerShell stage and the fake MP4 carrier file.

Introduction

On 22 August 2026, Censys ARC observed a Cloudflare-fronted host serving raw PowerShell as text/html over port 80. The script checks the computer name against two hard-coded values (variations on the word ‘clean’ that, if present, cause the script to exit), hides its console, decodes a second PowerShell stage from a base64 blob, and retrieves an MP4 file from the same host on a different path. Embedded within that file is the encrypted PowerShell payload, ultimately dropping and executing the NetSupport client binary and configuration files used to continue the infection chain.

The delivery infrastructure appears to have been built on 21 August, the same day the command-and-control domains were registered. We have since identified 18 builds distributed across 40 live endpoints in six autonomous systems and four countries. Each build ultimately installs a NetSupport Manager client configured to operate silently and communicate through two gateway domains registered just 77 seconds apart.

We have previously documented the malicious use of NetSupport Manager, a legitimate remote administration tool frequently abused by threat actors. What makes this activity notable is its delivery method: a structurally valid MP4 file that passes a basic file-type check while carrying an encrypted, compressed 16.8 MB PowerShell script.

The analysis below reconstructs the full delivery chain, explains how the payload is stored within the MP4 box structure, and shows how the embedded key is used to decrypt and decompress it.

Censys ARC Perspective

We initially identified one host. Pivoting on stable, operator-selected strings instead of build-specific values expanded that starting point to the live footprint summarized below.

  • 40 live stage-1 endpoints
    The confirmed live delivery surface.
  • 18 distinct builds
    Each uses its own parser-class name.
  • 21 hosts on the largest build
    The dominant byte-identical stage-1 body.
  • 14 carrier URLs
    Distributed across 12 carrier hosts.
  • 2 C2 gateways
    One active and one staged without an A record.

The kit is hosted on 12 origin servers. Another 12 Cloudflare edge addresses front roughly half of the hostnames, while the remaining names and bare-IP endpoints expose the origins directly.

Hosting and Geography

  • AS207043 — DEDIK-IO
    5 delivery hosts in Frankfurt am Main and Los Angeles.
  • AS210457 — KYONIX
    3 delivery hosts in Frankfurt am Main.
  • AS202412 — OMEGATECH-AS
    2 delivery hosts in Frankfurt am Main.
  • AS201988 — VPSPay-ASN
    1 delivery host in Helsinki.
  • AS399629 — BLNWX
    1 delivery host in Los Angeles.
  • AS209413 — DEDIK-CH
    1 C2 gateway in Bellinzona.

Five providers host delivery infrastructure, while a sixth hosts the C2 gateway. DEDIK SERVICES LIMITED is the only provider represented in both tiers, through AS207043 in Frankfurt and AS209413 in Bellinzona. The three KYONIX hosts serve builds first observed on 24 and 25 August.

Surfacing the Cluster

You can use the following query to surface the activity cluster:

web.endpoints.http.body: "__HideConsole" and web.endpoints.http.body: "ProgramData"

View in Censys Platform

Attack Flow

Diagram showing the progression from a likely paste-and-run entry point to an MP4-based payload parser, culminating in the deployment of a NetSupport client communicating with primary and staged gateways.
Observed delivery chain. Inferred elements, such as the initial Run-dialog entry point suggested by RunMRU cleanup, use dashed outlines. Directly observed assets, including the shared origin serving both stage 1 and the MP4 carrier, use solid outlines. The C2 gateway remains the only external component.

1. Inferred Entry Point

While the specific lure was not captured, stages 2 and 3 systematically purge HKCU\…\Explorer\RunMRU. This suggests the chain begins with a command executed via the Windows Run dialog, though the exact social engineering pretext is unknown. A common technique that leverages the Windows Run dialog is Click-Fix or some variation of instructive self-infection.  For demonstration purposes the inferred entry point is labeled as such.

2. Stage 1: Environment-Aware Dropper

The delivery host serves PowerShell source as raw text/html. The script immediately validates the target environment by comparing %COMPUTERNAME% against base64-encoded and XOR-encoded markers (*CLEAN* and CLEN). It then invokes a C# shim to suppress the console, introduces brief jitter, and verifies a run-once marker in %ProgramData%.

Excerpt of the first-stage PowerShell script highlighting sandbox detection strings and the HideConsole implementation.
Stage 1. The initial script performs environment checks, suppresses the console window, and validates its persistence marker.

The sandbox guards utilize varied encodings across the 18 identified builds, complicating simple keyword-based detection. The .ch_ file(found in the final line of the script) is the validation check to prevent the infection of a host that is already infected. The final stage writes this marker, while earlier stages merely confirm its absence before proceeding.

3. Stage 2: Media Carrier Retrieval

The first stage drops a secondary script in %TEMP% and launches it silently. This parser dynamically compiles a C# class to retrieve the carrier file using a fake Chrome UA (User-Agent). It then scans the ISO-BMFF box structure(inside of the MP4) for a uuid entry matching a build-specific 16-byte selector.

Parser code showing the logic for walking ISO-BMFF atoms and matching build-specific identifiers.
Stage 2. The parser identifies the target uuid box to extract the encrypted payload.

This process ensures the request appears as standard media traffic. If the specific selector is absent — often the case when older builds meet newer carriers — the script terminates, generating a uuid box missing error.

4. The Carrier: Non-Functional Media

The carrier is a 6.5 MB file that passes shallow file type checks but is effectively empty. A single uuid box occupies 99.95% of the file, containing an XOR key and compressed PowerShell that expands to nearly 17 MB. The remaining container structure is truncated and rejected by standard decoders like ffprobe (which is the tooling of choice for validating MP4 files).

Diagram showing the carrier composition, dominated by a massive private metadata box.
Proportionally, the private uuid box dwarfs the container headers, which lack the parameters necessary for actual playback.

The “video” track has zero-by-zero dimensions and lacks critical decoding parameters. It is a convincing shell designed solely to pass automated file-type inspections while masking the transport of a large script.

Terminal output demonstrating decoder errors and missing media tracks.
Decoder failure. Standard tools confirm the media is unplayable despite the valid container ID.

The structural analysis confirms this is a pure delivery vehicle. No media player can render the 28-byte samples, as they lack valid codec headers and spatial dimensions.

Detection Insight: Identifying Anomalous Carriers

The carrier’s reliance on private boxes makes it a distinct detection target. Flagging files that identify as MP4 but fail to decode, or those containing nearly all their data in uuid boxes, offers an efficient way to intercept the payload before extraction.

Script transcript showing the manual decryption and decompression of the payload.
Static unpacking. The payload can be recovered without execution by applying the embedded XOR key directly to the uuid box content.

Because the XOR key resides within the box itself we can use it to recover the rest of the chain and unpack the third stage script.

Operational Impacts of Carrier Rotation

The operator frequently rotates carriers without maintaining backward compatibility. This breaks older deployments, as the parser fails to find its build-specific selector and exits, even if the primary dropper endpoint remains accessible.

5. Stage 3: Deployment and Persistence

The final stage installs the NetSupport client into a randomized C:\Users\Public subdirectory. 

The bundle includes various legitimate redistributables (Vulkan, SwiftShader) to mimic a standard software installation. NetSupport has historically been seen deployed with legitimate decoy binaries, likely in an attempt at defense evasion or hindering incident response or analysis. 

Ultimately the script configures the client for silent operation and establishes persistence via the SecurityHealth Run key.

PowerShell excerpt detailing the persistence mechanism and run-once marker creation.
Stage 3. The script deploys the payload, establishes a decoy Run key, and completes the run-once marker.

The use of the SecurityHealth name provides a level of masquerade by mimicking the Windows Defender tray process. Once the %ProgramData% marker is written, the system is marked as successfully infected, preventing redundant dropper execution.

The client configuration is stored in client32.ini:

Configuration file settings for silent operation and C2 polling.
NetSupport profile. The ini suppresses all visible UI components and points to the gateway pair on port 443.

The deployed client configuration is heavily locked down, with all interactive features disabled. Registry paths and internal filenames suggest the toolkit was finalized on a system belonging to “Administrator,” utilizing a common NSM1234 license block.

6. Command and Control Infrastructure

The primary gateway, gojirotomiodid[.]com, resides on a host geolocated to Bellinzona, Switzerland that was previously used for a Russian ISP decoy. It now exposes a WebSocket upgrade on port 443 for C2 traffic. A secondary gateway domain (also defined in the config file) remains staged without an active DNS record.

The two C2 domains were registered less than 80 seconds apart. This tight registration window coincided with the reconfiguration of the delivery origin, suggesting a coordinated infrastructure deployment across both tiers.

Operational Security: Shared Decoy Patterns

Both the delivery and C2 origins utilize Russian-language business sites as facades. These decoys occupy the primary HTTPS port to present an appearance of legitimacy to casual visitors, while the malware delivery and command channels operate in parallel.

Build Inventory

Each build utilizes unique parser classes and persistence markers. Carrier URLs remain the most stable identifiers across the identified cluster.

  • 13fc18e817241856dcef3989d6986a2dd428f3f4e31a4815723ea9510999a61c
    Live hosts: 20 | Parser: __X198665813e | Marker: No marker recorded | Carrier: binance-idexchange[.]com/333.mp4
  • 1e9e7cdedcd4d20eb846a0268bccdb6aa817662516fb7cf62be930031c2c1885
    Live hosts: 2 | Parser: __Xb8150a0a73 | Marker: .ch_7dde4b428f3c | Carrier: google[.]2oauth[.]com/go.mp4
  • 512651fc5770932be61f513294fb738216d3ba923bda47bfcd5b328e2fc5636c
    Live hosts: 2 | Parser: __X69b4c83cc8 | Marker: No marker recorded | Carrier: hxxps://brmconfig[.]com/video.mp4
  • 07887055939e238184514110da990226b02e804e2371cb309487f7159171a3e7
    Live hosts: 1 | Parser: __X143c3ae343 | Marker: .ch_d3280c55f288 | Carrier: web02message[.]com/web02message.mp4
  • b59c9d532b2593cb0331f2f97f68896702bb5e8e868e2f07913542e4cbf7e195
    Live hosts: 1 | Parser: __X2303a83c86 | Marker: .ch_99d4fb13c272 | Carrier: fdn4apex[.]com/fdn4apex.mp4
  • ee2c978c13fb248005b9c5d82b231fc7b38f9a3281ff1f73132b0ec0363b0b18
    Live hosts: 1 | Parser: __X807b9f7426 | Marker: .ch_0d27fde0a2d4 | Carrier: x2664[.]com/x2664.mp4
  • 2c24d7a819f8d15a1104875e20b7831be9a02580c01a349f6e39f3790b41b81c
    Live hosts: 1 | Parser: __Xd50371fad6 | Marker: No marker recorded | Carrier: hxxp://89[.]34[.]90[.]111/tzast.mp4
  • 533428a3cf69e6fbf7a0b34f8915f8b9f6ba2e012ab8c9172e636f76b0f1d565
    Live hosts: 1 | Parser: __X56e23ccf21 | Marker: No marker recorded | Carrier: binance-idexchange[.]com/333.mp4
  • 84ad46c293d749dbacc68a3bcf4a6a964343aa444a3b12e103cfe8f962f24762
    Live hosts: 1 | Parser: __X9813bb95d1 | Marker: No marker recorded | Carrier: hxxps://hurmadll[.]com/twenty.mp4
  • 98cdd6ef9f5e6c06154423ab221550b683f2a4c9018d88ffcce085f92be88b6d
    Live hosts: 1 | Parser: __X1f97d075cc | Marker: No marker recorded | Carrier: hxxp://tidalcoastapparel[.]com/s.mp4
  • bf3da65748ada560e893f4952c6bafab53ebf1b888a535092d2815f0f93ec781
    Live hosts: 1 | Parser: __X252445155f | Marker: No marker recorded | Carrier: binance-idexchange[.]com/333.mp4
  • c32d53280bca6e28060c44c43bd688a7d36e315909bb36ddaebb4d6517debeae
    Live hosts: 1 | Parser: __Xeb38e5923e | Marker: No marker recorded | Carrier: karlenagida[.]com/player.mp4
  • da7c33e5770216c550cc6dd67a1fc3194a10102e6f064df11f6241fe24c999c5
    Live hosts: 1 | Parser: __Xfdf0602d52 | Marker: No marker recorded | Carrier: binance-idexchange[.]com/333.mp4
  • dadc9e33f8a1063c7cbd696e7527b45169075c708870b1b00f0cccddede1f1fb
    Live hosts: 1 | Parser: __X8ae32655a2 | Marker: No marker recorded | Carrier: usersecuritycheck[.]com/12.mp4
  • e0a40fb1573c73316920c296574b90cc52072e337b5c3e5b16355dfc3e306c44
    Live hosts: 1 | Parser: __Xda366bf04a | Marker: No marker recorded | Carrier: approvalrequest-api[.]com/333.mp4
  • 9862075e68c565d5ad78b8a0dcf6c193092103c9607899c72eefa482b9c8f008
    Live hosts: 0 | Parser: __X6c4b9c8b90 | Marker: No marker recorded | Carrier: hxxp://approvalrequest-api[.]com/55555555.mp4
  • b13da09f347597ea72d3ab075265bb37ae86c24f8c8cc6545e5255c9703dee1d
    Live hosts: 0 | Parser: __X653cb3fa74 | Marker: No marker recorded | Carrier: karlenagida[.]com/123.mp4
  • eb819bf728b64b98a1c7e91e7da428addb8108a1ccd9500023952084e5a036ca
    Live hosts: 0 | Parser: __X39aa924a6f | Marker: No marker recorded | Carrier: hxxp://89[.]34[.]90[.]111/tzast.mp4

IOCs

Indicators are grouped by functional stage. Network assets include observed activity windows; static artifacts use the date of initial recovery.

Stage 1: Delivery Endpoints

Identified endpoints serving the primary dropper. Distribution includes a mix of Cloudflare-fronted domains and direct IP origins.

  • 144[.]31[.]106[.]164:80
    Type: stage-1 host | First seen: 2026-08-25 | Last seen: ongoing
  • 85[.]239[.]144[.]68:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • brevantweuijdis[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • leybers[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • liviliy[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • lozopro[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • lumirevax[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • lumirevion[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • meeggs[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • mimede[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • miralunexerfty[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • nexorivapgfk[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • permanenttrajectories[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • silvariona[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • solaventro[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • soltrivena[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • solvariquejio[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  •  talmorvexa[.]world:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • tervixacom[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • virellixerxa[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • www[.]maxintora[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • 2[.]26[.]252[.]75:80
    Type: stage-1 host | First seen: 2026-08-25 | Last seen: ongoing
  • 2oauth[.]com:80
    Type: stage-1 host | First seen: 2026-08-25 | Last seen: ongoing
  • 89[.]34[.]90[.]111:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • 91[.]92[.]240[.]175:443
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • brmconfig[.]com:443
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • update[.]maxintora[.]com:80
    Type: stage-1 host | First seen: 2026-08-23 | Last seen: 2026-08-23
  • 178[.]16[.]52[.]165:443
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • tidalcoastapparel[.]com:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24
  • 2[.]26[.]252[.]95:80
    Type: stage-1 host | First seen: 2026-08-25 | Last seen: ongoing
  • silvarvexa[.]world:80
    Type: stage-1 host | First seen: 2026-08-23 | Last seen: 2026-08-23
  • 67[.]217[.]228[.]22:443
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • 1c[.]maxintora[.]com:80
    Type: stage-1 host | First seen: 2026-08-23 | Last seen: 2026-08-23
  • 2[.]27[.]160[.]137:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: ongoing
  • 91[.]92[.]34[.]109:80
    Type: stage-1 host | First seen: 2026-08-23 | Last seen: 2026-08-24
  • 31[.]76[.]103[.]182:80
    Type: stage-1 host | First seen: 2026-08-24 | Last seen: 2026-08-24

Stage 1: Script Hashes

Hashes for the various first-stage dropper builds. These reflect unique builds and are subject to frequent rotation.

  • 13fc18e817241856dcef3989d6986a2dd428f3f4e31a4815723ea9510999a61c
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: ongoing
  • 1e9e7cdedcd4d20eb846a0268bccdb6aa817662516fb7cf62be930031c2c1885
    Type: stage-1 body SHA-256 | First seen: 2026-08-25 | Last seen: ongoing
  • 512651fc5770932be61f513294fb738216d3ba923bda47bfcd5b328e2fc5636c
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: ongoing
  • 07887055939e238184514110da990226b02e804e2371cb309487f7159171a3e7
    Type: stage-1 body SHA-256 | First seen: 2026-08-25 | Last seen: ongoing
  • b59c9d532b2593cb0331f2f97f68896702bb5e8e868e2f07913542e4cbf7e195
    Type: stage-1 body SHA-256 | First seen: 2026-08-25 | Last seen: ongoing
  • ee2c978c13fb248005b9c5d82b231fc7b38f9a3281ff1f73132b0ec0363b0b18
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: 2026-08-24
  • 2c24d7a819f8d15a1104875e20b7831be9a02580c01a349f6e39f3790b41b81c
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: ongoing
  • 533428a3cf69e6fbf7a0b34f8915f8b9f6ba2e012ab8c9172e636f76b0f1d565
    Type: stage-1 body SHA-256 | First seen: 2026-08-23 | Last seen: 2026-08-23
  • 84ad46c293d749dbacc68a3bcf4a6a964343aa444a3b12e103cfe8f962f24762
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: 2026-08-24
  • 98cdd6ef9f5e6c06154423ab221550b683f2a4c9018d88ffcce085f92be88b6d
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: 2026-08-24
  • bf3da65748ada560e893f4952c6bafab53ebf1b888a535092d2815f0f93ec781
    Type: stage-1 body SHA-256 | First seen: 2026-08-23 | Last seen: 2026-08-23
  • c32d53280bca6e28060c44c43bd688a7d36e315909bb36ddaebb4d6517debeae
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: ongoing
  • da7c33e5770216c550cc6dd67a1fc3194a10102e6f064df11f6241fe24c999c5
    Type: stage-1 body SHA-256 | First seen: 2026-08-23 | Last seen: 2026-08-23
  • dadc9e33f8a1063c7cbd696e7527b45169075c708870b1b00f0cccddede1f1fb
    Type: stage-1 body SHA-256 | First seen: 2026-08-24 | Last seen: ongoing
  • e0a40fb1573c73316920c296574b90cc52072e337b5c3e5b16355dfc3e306c44
    Type: stage-1 body SHA-256 | First seen: 2026-08-23 | Last seen: 2026-08-24
  • 9862075e68c565d5ad78b8a0dcf6c193092103c9607899c72eefa482b9c8f008
    Type: stage-1 body SHA-256 | First seen: 2026-08-22 | Last seen: not live
  • b13da09f347597ea72d3ab075265bb37ae86c24f8c8cc6545e5255c9703dee1d
    Type: stage-1 body SHA-256 | First seen: 2026-08-23 | Last seen: not live
  • eb819bf728b64b98a1c7e91e7da428addb8108a1ccd9500023952084e5a036ca
    Type: stage-1 body SHA-256 | First seen: 2026-08-23 | Last seen: not live

Stage 2: Carrier Artifacts

Carrier URLs recovered from second-stage logic. Most remain unprobed, though the binance-idexchange asset was actively confirmed.

  • hxxp://89[.]34[.]90[.]111/tzast.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-23
  • hxxp://approvalrequest-api[.]com/333.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-23
  • hxxp://approvalrequest-api[.]com/55555555.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-22
  • hxxp://binance-idexchange[.]com/333.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-23
  • hxxp://fdn4apex[.]com/fdn4apex.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-25
  • hxxp://google[.]2oauth[.]com/go.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-25
  • hxxp://karlenagida[.]com/123.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-23
  • hxxp://karlenagida[.]com/player.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-24
  • hxxp://tidalcoastapparel[.]com/s.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-24
  • hxxp://usersecuritycheck[.]com/12.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-24
  • hxxp://web02message[.]com/web02message.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-25
  • hxxp://x2664[.]com/x2664.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-25
  • hxxps://brmconfig[.]com/video.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-24
  • hxxps://hurmadll[.]com/twenty.mp4
    Type: stage-2 carrier URL | Observed: 2026-08-24

Stage 3: Payload Hashes

File hashes for the carrier, the recovered script, and all dropped NetSupport components. Filenames are reproduced exactly as observed.

  • 6c7fc234ac22ff244dfd220abdf1de3e987a4e785f65dd5a0bff1c639521a10b
    Type: carrier file SHA-256 | Observed: 2026-08-25
  • ce61f3c40a71659843ad0defa40e226ba7d51b594ce09af4e496c661c6b7a09f
    Type: stage-3 script SHA-256 | Observed: 2026-08-25
  • 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422
    Type: dropped file (apP.eXE) | Observed: 2026-08-25
  • 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
    Type: dropped file (aUdiocaptUrE.DlL) | Observed: 2026-08-25
  • edb68fc8857d9c789c7cac806ccf988008a898bf5e8fe61908f558666eceefed
    Type: dropped file (gxjee.ini) | Observed: 2026-08-25
  • 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
    Type: dropped file (HtCtl32.DLL) | Observed: 2026-08-25
  • 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
    Type: dropped file (mSvCr100.dLL) | Observed: 2026-08-25
  • d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
    Type: dropped file (NsKBflTR.inF) | Observed: 2026-08-25
  • 4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
    Type: dropped file (NSm_VprO.ini) | Observed: 2026-08-25
  • e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d
    Type: dropped file (NsM.ini) | Observed: 2026-08-25
  • e09980d1b1c508eb29d2931ac92f8d0a7e49ca5fe6ab6277fabf097a0b033b63
    Type: dropped file (NsM.LIC) | Observed: 2026-08-25
  • 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
    Type: dropped file (pCicApi.dll) | Observed: 2026-08-25
  • 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
    Type: dropped file (PcIchEK.dLL) | Observed: 2026-08-25
  • 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
    Type: dropped file (PcIcl32.DLL) | Observed: 2026-08-25
  • b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2
    Type: dropped file (rEmCmDstub.eXE) | Observed: 2026-08-25
  • b0935a6e5a81f3bed34367ebb87a96543a5a2a2b2fe4596e96e655b7715a3e28
    Type: dropped file (REW.BIn) | Observed: 2026-08-25
  • 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299
    Type: dropped file (tCctl32.DLL) | Observed: 2026-08-25
  • 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
    Type: dropped file (vK_sWiftshADEr_Icd.jSon) | Observed: 2026-08-25
  • aa4fc4eb78d08de797220a8b9c1db3f8a584ffcb85dda47b71a11eb306280395
    Type: dropped file (vk_SwifTsHaDEr.Dll) | Observed: 2026-08-25
  • c36b5c170d1e59a957fc67f17df28605e275ec6e01f3d4c03531f6fd251c5189
    Type: dropped file (VUlkan-1.dll) | Observed: 2026-08-25
  • 2edf10f0af08c32b7721becc063297d09362e76e1f5a18f0d81837752363b578
    Type: dropped file (WdaG.dll) | Observed: 2026-08-25
  • e6b595c19b931960c18d562fe16bd4fa05d724b812d10945c2f965bf836783a8
    Type: dropped file (WebVIew2_iNtEgRatION.DLl) | Observed: 2026-08-25

Stage 4: Host-Based Signatures

Registry and filesystem markers that persist across different build generations.

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run value SecurityHealth
    Type: Persistence marker (mimics Windows Defender) | Observed: 2026-08-25
  • C:\Users\Public\<subdir>\.ch_boot.cmd
    Type: Local launcher script | Observed: 2026-08-25
  • %ProgramData%\.ch_<12 hex>
    Type: Global run-once indicator | Observed: 2026-08-25
  • %TEMP%\<guid>.ps1
    Type: Intermediate staging path | Observed: 2026-08-25
  • HKCU\...\Explorer\RunMRU cleanup
    Type: Forensics suppression activity | Observed: 2026-08-25
  • *CLEAN* and CLEN guards
    Type: Environment-based sandbox detection | Observed: 2026-08-22
  • __HideConsole
    Type: Console-hiding class string | Observed: 2026-08-22
  • __X<10 hex>
    Type: Dynamic parser class name | Observed: 2026-08-22

C2 Infrastructure: Network

The primary and secondary gateways identified in the toolkit’s network logic.

  • gojirotomiodid[.]com:443
    Type: Active C2 gateway | First seen: 2026-08-21 | Last seen: ongoing
  • kolitersdones[.]com:443
    Type: Staged secondary gateway | First seen: 2026-08-21 | Last seen: ongoing
  • 176[.]65[.]144[.]164
    Type: C2 origin server (Bellinzona) | First seen: 2026-08-22 | Last seen: ongoing
  • mmm-vps[.]online
    Type: Previous decoy on C2 origin | First seen: 2026-06-16 | Last seen: 2026-08-15

C2 Infrastructure: Configuration

Operational parameters extracted from the NetSupport profile.

  • GK:E<J@PEG:L@JBNGD9J=A@HBI
    Type: Encoded gateway secret key | Observed: 2026-08-25
  • dgAAAPpMkI7ke494fKEQRUoablcA
    Type: RADIUS security secret | Observed: 2026-08-25
  • NSM1234
    Type: Licensing and serial metadata | Observed: 2026-08-25
  • CMPI=60
    Type: Configured C2 poll interval (seconds) | Observed: 2026-08-25

Related Infrastructure

Supporting assets and decoy entities identified during tracking.

  • 85[.]239[.]144[.]68
    Type: Delivery origin server | First seen: 2026-06-17 | Last seen: ongoing
  • ceelorn[.]com
    Type: Furniture store decoy domain | First seen: 2026-08-17 | Last seen: 2026-08-19
  • 2d7285c93866597e28c4686194456e9a6eb22fe80287461990da13dab1a9e0b5
    Type: Decoy TLS certificate fingerprint | First seen: 2026-08-17 | Last seen: 2026-08-19
  • b0199da4b67416f24f3d235b4d6d64d2b9cff96f3e38141e3920b90b5bf633e6
    Type: Port-1010 banner fingerprint | First seen: 2026-08-18 | Last seen: ongoing
A man with long blonde hair, a mustache and goatee, wearing a dark suit and black shirt, against a blue background.
AUTHOR
Andrew Northern
Principal Security Researcher

Andrew Northern is a Principal Security Researcher with Censys ARC focused on tracking the apex predators of the initial-access e-crime landscape. His work targets the most capable operators, uncovering novel attack chains and dynamic web-delivered malware while mapping the infrastructure that enables them. He has earned multiple MITRE ATT&CK citations, discovered and named several espionage-focused malware families, and published research that exposes previously unknown tradecraft.

Share
Back to resource hub
Related Content
View all
Blog
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Blog
Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption 
Illustration of two fishing hooks fishing coins from 2 mobile phones
Blog
What the ERMAC Source Leak Says About HookBot

US: +1-888-985-5547

Intl: +1-877-438-9159

connect@censys.com

Subscribe to our newsletter

Subscribe to our newsletter

Copyright © 2026 Censys  |  Data Retention Policy  |  Terms & Conditions  |  Privacy Policy  |  Brand