A newly discovered malware framework called NetamLoader is being employed against a customized version of Windows 10 exclusively used by government entities in Asia This article explores called netamloader employed. . The second phase disables security measures.
It then uses a remote COM object to start the final payload inside dllhost.exe, which separates it from the initial process and aids in evading EDR behavior checks.
Slow Command Channel Keeps the Malware Hidden The final component, known as the .NET 2 Plugin, communicates with a command-and-control (C2) server at openaigpt4v[.]com. All traffic uses AES encryption with HMAC verification, and the malware searches for a proxy in three different ways, allowing it to operate in locked-down networks. The report suggests that countries developing their own operating systems must protect the entire software chain themselves, and that this process takes time.
Here are the indicators of compromise (IoCs): Type Indicator Description Hash / archive name CAB archive Hash Listed first in the report’s file-hash block Hash Resources.resx Hash .NET 1 Loader Hash .NET 2 Plugin Hash fabric.config Hash PatchMyPC-ScriptRunner.exe.config Hash XAML-1 Hash XAML-2 Hash XAML-2-1 Hash XAML-2-2 Hash XAML-3 File path C:\Windows\SoftwareDistribution\Download\Install\PatchMyPC-ScriptRunner.exe.config Malicious config file File path C:\Windows\SoftwareDistribution\Download\Install\fabric.config Malicious config file File path C:\Windows\SoftwareDistribution\Download\Install\Resources.resx Payload container Domain openaigpt4v[. ]com C2 server IP address 104.18.14[. ]219 C2 IP (Cloudflare) Securely integrate alerts into controlled threat intelligence platforms like MISP, VirusTotal, or your SIEM.
