OnionDrop

ErrTraffic begins after someone reaches a compromised WordPress website. The injected JavaScript does not contain the final destination in clear text.

MITRE ATT&CK Coverage Initial Access ◦ T1566.001 Phishing: Spearphishing Attachment

Its PowerShell command can fetch both a randomly named 7-Zip program and a randomly named payload, or download the payload directly.

ErrTraffic begins after someone reaches a compromised WordPress website. The injected JavaScript does not contain the final destination in clear text.

This includes resolving LdrLoadDll, which loads bcrypt.dll while bypassing the more commonly hooked LoadLibrary call.

Instead of exploiting a software flaw, the page tells a visitor to copy and paste a supposed fix, often into the Windows Run box or PowerShell. | The campaign, tracked as ErrTraffic, turns hacked WordPress sites into launch points for fake verification prompts that persuade visitors to run harmful Windows commands. The trick is known as ClickFix.

MITRE ATT&CK Coverage Initial Access ◦ T1204.002 User Execution: Malicious File

The loader employs advanced evasion techniques, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis mechanisms, and shellcode execution through Windows Thread Pool callbacks...

The loader employs advanced evasion techniques, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis mechanisms, and shellcode execution through Windows Thread Pool callbacks...

Four-stage unpack chain. Custom byte-pair decoding, Xpress Huffman decompression, AES-256-CBC with rotating key context, ending in Donut shellcode.

Stack-string construction, dynamic API resolution via LdrGetProcedureAddress, API hammering, and display device enumeration defeat both static and dynamic analysis at every stage.

The malware combines stack-based strings with custom decryption logic to reconstruct sensitive strings at runtime, defeating static detection.

A legitimate Adobe-signed executable, setup.exe (originally named AcroBroker.exe), sideloads the malicious dependency named sqlite.dll.

The loader employs advanced evasion techniques, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis mechanisms, and shellcode execution through Windows Thread Pool callbacks...

The encoded contents pass through a custom decoding routine ... before being handed to subsequent decryption and decompression stages.

ZIP archive paired with a legitimate Adobe-signed executable initiates execution through sideloading.

The loader employs advanced evasion techniques, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis mechanisms...

Before executing its malicious logic, the malware queries the display device name through EnumDisplayDevicesA.

The malware avoids this by spawning a separate thread, waiting briefly via a short sleep interval, and returning from DllMain with a value of 1.

The loader employs advanced evasion techniques, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis mechanisms, and shellcode execution through Windows Thread Pool callbacks...

The decrypted output reveals a series of Win32 API names resolved dynamically, alongside an embedded shellcode payload mapped into memory and executed through callback-based execution mechanisms.

Before executing its malicious logic, the malware queries the display device name through EnumDisplayDevicesA.

The loader employs advanced evasion techniques, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis mechanisms...

Before executing its malicious logic, the malware queries the display device name through EnumDisplayDevicesA.

The malware avoids this by spawning a separate thread, waiting briefly via a short sleep interval, and returning from DllMain with a value of 1.

Its PowerShell command can fetch both a randomly named 7-Zip program and a randomly named payload, or download the payload directly.

MITRE ATT&CK Coverage ... Command and Control ◦ T1132 Data Encoding

Instead, it queries Polygon through remote procedure call services, retrieves configuration from a smart contract, and uses that answer to locate current attacker-controlled infrastructure.