GollopDevest

The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli / ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths.

Reads the config data/.GEg and decrypts it using Base64 decoding and XOR... XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP... During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The malware then downloads the next stages of the attack from that server... The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org | That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain.

uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide... and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.