Multi-stage loaders use DLL sideloading and signed binaries to hide final payloads

Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed Eimeria, starts from a RAR5 archive containing the signed dsclock.exe, a malicious zlibwapi.dll, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores ntdll.dll to evade EDR hooks, decrypts later stages with AES-128-CBC, RC4, and LZNT1, hollows explorer.exe, svchost.exe, or taskhostw.exe, and injects a small .NET RAT that beacons over WebSocket to 94.26.90.139:3006. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis.

A second intrusion set tied to UAC-0184 / MB-0007 used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with LNK files that called bitsadmin to fetch HTA content from 169.40.135.35 for execution via mshta. The downloaded archive abused legitimate Plane9 components for sideloading through Cluster-Overlay64.exe, Plane9Engine.dll, and openvr_api.dll, then decoded kernel-diag.lib into evr.dll and unpacked filter.bin by rebuilding IDAT chunks, XOR-decoding with key 0x227E9BDE, and decompressing with LZNT1. The final bundle included signed utilities such as Microsoft-signed VSLauncher.exe and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast 224.0.0.255:31339 and TCP 31339 rather than a fixed external C2.