Loading story…
Researchers documented a multi-stage PowerShell malware delivery chain that served script content directly from 203[.]188[.]171[.]166 and dorenzaa[.]com, then pulled additional payloads from Vercel-hosted infrastructure. The observed chain downloaded archives and executables including Grape2.zip, UltraToolliteSetup.exe, and draw.zip, extracted them into user directories such as %LOCALAPPDATA%\jsDownload and %APPDATA%, and launched files including Grape.exe. Investigators said the infrastructure behaved like a staged loader rather than a normal website, with multiple remote components used to fetch and run follow-on payloads.
The PowerShell loaders used hidden execution, dynamically constructed IEX, Base64 decoding, and repeating-key XOR obfuscation with the key "write", while displaying a decoy prompt reading "Verification complete!" under the window title "Google.com". Analysts published indicators including the IP address, domain, file names, hashes, and execution paths, but said the initial infection vector and the ultimate functionality of several downloaded executables remained undetermined, and no threat actor attribution was made.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
A post on r/netsec referenced the analysis of the multi-stage PowerShell payload chain and shared initial indicators including 203[.]188[.]171[.]166 and dorenzaa[.]com. The post highlighted obfuscated loaders, hidden execution, Base64 and XOR decoding, and the decoy "Verification complete!" prompt.
The file 4_27_1.txt was identified as another heavily obfuscated PowerShell loader. After deobfuscation, it was shown to download draw.zip, save it as %APPDATA%\draw.zip, extract it into %APPDATA%\Default, and execute %APPDATA%\Default\draw.io.exe; the reported SHA-256 for draw.zip was a25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1.
Analysis of the heavily obfuscated loader1.txt showed it decoded embedded Base64 data and applied a repeating-key XOR using the key "write." The deobfuscated script downloaded UltraToolliteSetup.exe, saved it as %APPDATA%\UltraToolliteSetup.exe, and executed it; the reported SHA-256 was d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64.
The investigation found loader2.txt and loader22.txt contained the same PowerShell stager, with SHA-256 f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530. The stager launched hidden PowerShell, downloaded loader1.txt, dynamically constructed IEX, and displayed a decoy "Verification complete!" prompt titled "Google.com."
The analysis identified a second Vercel host, file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app, hosting files including UltraToolliteSetup.exe, mat.zip, draw.zip, loader1.txt, loader2.txt, loader22.txt, 1.txt, and 4_27_1.txt. The content notes that co-location on the same Vercel instance alone does not prove all files belong to one campaign.
PowerShell retrieved Grape2.zip from file-host-alpha[.]vercel[.]app, created %LOCALAPPDATA%\jsDownload, extracted the archive there, and executed %LOCALAPPDATA%\jsDownload\Grape.exe. The reported SHA-256 for Grape2.zip was 3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61.
The investigation identified 203[.]188[.]171[.]166 and dorenzaa[.]com as locations serving PowerShell code directly rather than normal web content, likely acting as second-stage delivery points. The initial infection vector was not identified.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcemalware.news
Open sourcemalwr-analysis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers documented multiple malware delivery chains using PowerShell-based loaders to fetch and execute credential theft and remote access payloads. In one campaign tied to **NullMixer**, a 32-bit loader masquerading as `sqlcmd.exe` pulled a script from a compromised WordPress site, decrypted an embedded .NET assembly, and launched the **Koi** stealer. Koi targeted credentials and data from browsers, **FileZilla**, **Discord**, **Telegram**, VPN clients, cryptocurrency wallets, and **Twilio Authy**, while also checking for **Trezor** hardware wallets; it used anti-analysis, anti-reinfection, and geofencing logic to avoid systems configured for several CIS countries. A separate PowerShell dropper hosted on `fancysunshine[.]top` was used to deploy **SectopRAT** and **HiJack Loader** while attempting to weaken defenses and erase evidence. The script added Windows Defender exclusions for the `C:` drive and selected processes, downloaded `NC.zip` and `RD.zip`, unpacked them into fake Chrome cache directories under `%TEMP%`, and executed `S-D.exe` from both locations. It also gathered the victim's external IP address and username, checked for a scheduled task named `MSSecurity`, exfiltrated results to `upload.php` over HTTP POST, and then deleted the archives, extracted files, output data, and the dropper itself to reduce forensic visibility.
Jun 29, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026