Loading story…
A multi-stage Windows malware chain has been documented in which a Python-based loader uses ctypes and .NET reflection to execute in memory, then patches AmsiScanBuffer and EtwEventWrite to weaken Microsoft antimalware scanning and event tracing before loading a base64-encoded .NET payload. The technique mirrors publicly discussed live DLL patching methods and shows how Python can be used to modify security-relevant functions at runtime to evade detection.
The decoded second stage is a PE32+ Mono/.NET assembly that copies itself to %LOCALAPPDATA%\Microsoft\_OneDrive.exe, creates %LOCALAPPDATA%\Xbox, and establishes persistence through an HKCU registry key and a Startup-folder shortcut that launches PowerShell. It then decodes and launches another embedded payload via aspnet_compiler.exe, ultimately deploying SwaetRAT, which copies itself to %APPDATA%\CCleaner.exe; the recovered configuration points to a command-and-control server at 144[.]126[.]149[.]221:7777, and the malware family matches samples previously observed in earlier campaigns.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The SANS analysis states that eSentire had previously covered the same SwaetRAT sample in 2023, indicating the malware had been documented before the 2025 write-up.
SANS Internet Storm Center published an analysis of a multi-stage Windows malware chain in which a Python loader patched AMSI and ETW functions in memory, launched a .NET stage, and ultimately deployed SwaetRAT. The analysis identified persistence mechanisms, file paths, and the final command-and-control endpoint 144[.]126[.]149[.]221:7777.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
dshield.org
Open sourceisc.sans.edu
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers at Point Wild reported a malware campaign that abuses the legitimate packaging tool **PyInstaller** to disguise and deliver **XWorm RAT v7.4** inside files presented as benign software or updates. The infection chain uses obfuscation and anti-analysis techniques, including a routine identified as `_IAT_PHANTOM_FIX`, then patches **AMSI** in memory to weaken Windows scanning before unpacking an encrypted payload. The malware is then dropped into `%LOCALAPPDATA%` as the hidden system file `Win.Kernel_Svc_AJ8iOw.exe`, helping it evade user notice and endpoint defenses. Once installed, the payload connects to command-and-control infrastructure at `68.219.64.89:4444` using an **AES** key and enables a broad set of remote-access capabilities. Point Wild said XWorm can steal passwords, access files, activate webcams, launch **DDoS** attacks, and provide full remote control; researchers also observed deployment of an additional file, `afacan313131.exe`, as part of the intrusion. The findings show how attackers are combining trusted developer tools with memory patching and encrypted payload delivery to make a well-known malware family harder to detect.
Jun 29, 2026
Researchers reported evolving **multi-stage, script-heavy infection chains** used to deliver remote access trojans, including **XWorm**, **AsyncRAT**, and **Xeno RAT**. Securonix described a campaign dubbed **VOID#GEIST** that starts from phishing-delivered batch scripts fetched from *TryCloudflare* infrastructure, then chains additional batch/PowerShell stages, deploys a legitimate embedded Python runtime, decrypts shellcode, and executes it filelessly by injecting into `explorer.exe` using **Early Bird APC injection**, reducing disk artifacts and making each stage appear benign in isolation. Separately, SANS ISC documented another **XWorm** wave using an obfuscated JavaScript-to-PowerShell loader chain that drops a temporary PowerShell script (e.g., `C:\Temp\ps_...ps1`), decodes additional in-memory PowerShell, and uses a DLL exporting `ProcessHollowing` to inject the XWorm client into a .NET compiler process. The write-up included configuration and IOCs such as a C2 endpoint `204[.]10[.]160[.]190:7003`, mutex `Cqu1F0NxohroKG5U`, and multiple SHA-256 hashes for the JavaScript, PowerShell, DLL loader, and XWorm payload, indicating continued high-volume distribution with frequently changing delivery techniques.
Jun 29, 2026