NetamLoader hides in Windows 10 update packages aimed at Asian governments
Original title: APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments
Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.
Securelist’s October 29 report covers NetamLoader, first flagged from a .config file inside a Windows update CAB on a government-only Windows 10 build. PatchMyPC-ScriptRunner.exe loads Microsoft-signed code that deserializes Resources.resx into XAML stages, including an AMSI patch and a .NET plugin that talks to openaigpt4v[.]com. How the archive arrived is unknown. Kaspersky detects it as HEUR:Trojan.MSIL.NetamLoader.gen and related families.
Unconfirmed: No group is attributed, delivery is unseen, and the government targeting claim rests on one telemetry victim and the custom build.
- The .NET 2 Plugin uses AES with HMAC and looks for a proxy.
- A watchdog closes the process after about 28 hours.
- The CAB hash listed is e4537a1762fcafd2fd96bfc825bad34f9db9a24d.
- Malicious configs are under SoftwareDistribution\Download\Install.
- After C2 failure it waits 22 to 28 hours.
Impact: Covert C2 and follow-on XAML execution on government Windows 10
| Product | Affected |
|---|---|
| Microsoft Windows 10 | custom version used only by Asian government bodies |
- 1.Watch update folders for unexpected config files and odd loads by signed programs.
- 2.Send logs to a central server because the malware wipes local copies.
- ATT&CK
- T1195 Supply Chain CompromiseT1562.001 Impair Defenses: Disable or Modify ToolsT1070 Indicator RemovalT1559.001 Inter-Process Communication: Component Object Model
- Vendors
- Microsoft
- Products
- Windows 10Patch My PC
- Malware
- NetamLoader
- Organizations
- Kaspersky
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | openaigpt4v.com | NET 2 Plugin, talks to a command-and-control (C2) server at openaigpt4v[.]com. The name looks like an AI service, but the domain sits b |
| ipv4 | 104.18.14.219 | oad container Domain openaigpt4v[.]com C2 server IP address 104.18.14[.]219 C2 IP (Cloudflare) Note: IP addresses and domains are int |
| md5 | 4f28622c5e60c01319bf48cf742fe1a5 | XAML-2 Hash B3C4A635179680EDAFB5D006CF0CFFC6 XAML-2-1 Hash 4F28622C5E60C01319BF48CF742FE1A5 XAML-2-2 Hash C86D53392A87DD3F3E62D62C9B92A9BD XAML-3 File |
| md5 | 514117d536e347560d049cfe0c609632 | 1B73488EF5E2E55A75C3 PatchMyPC-ScriptRunner.exe.config Hash 514117D536E347560D049CFE0C609632 XAML-1 Hash 9000820D8153C24CD60D53001D3A97B6 XAML-2 Hash B3 |
| md5 | 514ac0d73b8a1b73488ef5e2e55a75c3 | in Hash 67E3617F8709D34F806F8E02BADBA8A5 fabric.config Hash 514AC0D73B8A1B73488EF5E2E55A75C3 PatchMyPC-ScriptRunner.exe.config Hash 514117D536E347560D04 |
| md5 | 67e3617f8709d34f806f8e02badba8a5 | er Hash CFB8B281BDF5D9390E64B10C312FB2C1 .NET 2 Plugin Hash 67E3617F8709D34F806F8E02BADBA8A5 fabric.config Hash 514AC0D73B8A1B73488EF5E2E55A75C3 PatchMy |
| md5 | 9000820d8153c24cd60d53001d3a97b6 | xe.config Hash 514117D536E347560D049CFE0C609632 XAML-1 Hash 9000820D8153C24CD60D53001D3A97B6 XAML-2 Hash B3C4A635179680EDAFB5D006CF0CFFC6 XAML-2-1 Hash |
| md5 | ab81564bcb8ca7e710c66832de747556 | k Hash E1DC6F1ED193594F2284BE22AE08DFA4 Resources.resx Hash AB81564BCB8CA7E710C66832DE747556 .NET 1 Loader Hash CFB8B281BDF5D9390E64B10C312FB2C1 .NET 2 |
| md5 | b3c4a635179680edafb5d006cf0cffc6 | 32 XAML-1 Hash 9000820D8153C24CD60D53001D3A97B6 XAML-2 Hash B3C4A635179680EDAFB5D006CF0CFFC6 XAML-2-1 Hash 4F28622C5E60C01319BF48CF742FE1A5 XAML-2-2 Has |
| md5 | c86d53392a87dd3f3e62d62c9b92a9bd | AML-2-1 Hash 4F28622C5E60C01319BF48CF742FE1A5 XAML-2-2 Hash C86D53392A87DD3F3E62D62C9B92A9BD XAML-3 File path C:\Windows\SoftwareDistribution\Download\I |
| md5 | cfb8b281bdf5d9390e64b10c312fb2c1 | sx Hash AB81564BCB8CA7E710C66832DE747556 .NET 1 Loader Hash CFB8B281BDF5D9390E64B10C312FB2C1 .NET 2 Plugin Hash 67E3617F8709D34F806F8E02BADBA8A5 fabric. |
| md5 | e1dc6f1ed193594f2284be22ae08dfa4 | 0F577E98E Listed first in the report’s file-hash block Hash E1DC6F1ED193594F2284BE22AE08DFA4 Resources.resx Hash AB81564BCB8CA7E710C66832DE747556 .NET 1 |
| md5 | f2458ed133f8d0ca19e22c10f577e98e | e e4537a1762fcafd2fd96bfc825bad34f9db9a24d CAB archive Hash F2458ED133F8D0CA19E22C10F577E98E Listed first in the report’s file-hash block Hash E1DC6F1ED |
| sha1 | e4537a1762fcafd2fd96bfc825bad34f9db9a24d | ise (IoCs):- Type Indicator Description Hash / archive name e4537a1762fcafd2fd96bfc825bad34f9db9a24d CAB archive Hash F2458ED133F8D0CA19E22C10F577E98E Listed fi |
From the original article
4 min read at cybersecuritynews.com
A new malware framework called NetamLoader is being used against a custom version of Windows 10 that only government bodies in Asia use. The campaign looks like a supply-chain operation, and nobody has linked it to a known hacking group yet. The malware hides inside a Windows update package, borrows trusted software to run, and […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.