NetamLoader malware targets custom Windows 10 build used by Asian government bodies

The chain abuses PatchMyPC-ScriptRunner.exe.config for AppDomainManager injection, then fabric.config and Resources.resx to run XAML via a BinaryFormatter flaw. The first decryption key comes from the process command line, which defeats sandboxes. Later stages patch AMSI, delete Prefetch, .NET logs and CmitUpdateAgent log entries, and launch the payload through a remote COM object in dllhost.exe. The C2 is openaigpt4v[.]com behind Cloudflare (104.18.14[.]219), using AES with HMAC. Kaspersky detects it as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast. and Trojan.Script.Agent. Defenders should watch update folders for unexpected config files, odd loading by signed programs and missing log entries, and forward logs centrally.

For security analysts · Written by AI from 2 sources · Wrong?