NetamLoader malware targets custom Windows 10 build used by Asian government bodies
- Severity
- High
- Sources
- 3
What happened
The chain abuses PatchMyPC-ScriptRunner.exe.config for AppDomainManager injection, then fabric.config and Resources.resx to run XAML via a BinaryFormatter flaw. The first decryption key comes from the process command line, which defeats sandboxes. Later stages patch AMSI, delete Prefetch, .NET logs and CmitUpdateAgent log entries, and launch the payload through a remote COM object in dllhost.exe. The C2 is openaigpt4v[.]com behind Cloudflare (104.18.14[.]219), using AES with HMAC. Kaspersky detects it as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast. and Trojan.Script.Agent. Defenders should watch update folders for unexpected config files, odd loading by signed programs and missing log entries, and forward logs centrally.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- Keep devices updated and install software only from official stores or the maker’s site.
General advice for this kind of story
Full story timeline · 3 updates
- Fri 30 OctoberHackers target government Windows systems in Asia with new malwareThe Record
- APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian GovernmentsCyber Security News
- Sun 1 NovemberNetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET InjectionThe Hacker News