Unknown APT deploys NetamLoader on government Windows 10 builds in Asia
Original title: Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
Kaspersky traced a CAB in the Windows update folder to AppDomainManager injection and a layered .NET loader.
Kaspersky describes NetamLoader, a .NET loading framework it says points to a supply-chain attack on a custom Windows build used only by government entities in Asia. A CAB in the Windows update download directory hosted mostly legitimate Patch My PC and Microsoft-signed files, while a .config file used AppDomainManager injection. Nested payloads in Resources.resx were compressed, encrypted, or serialized. No known APT group is attributed, and delivery of the CAB was not observed.
Unconfirmed: How the CAB arrived is unknown, and Kaspersky has not attributed the activity to a known group.
- Detections include HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast, and Trojan.Script.Agent.
- The CAB hash is e4537a1762fcafd2fd96bfc825bad34f9db9a24d under SoftwareDistribution\Download.
- PatchMyPC-ScriptRunner.exe ran with an -updatepackage argument as the host process.
- A BinaryFormatter object inside Resources.resx unpacks further XAML, assemblies, and JSON.
Impact: Multi-stage .NET loader on government Windows systems
| Product | Affected |
|---|---|
| Microsoft Windows 10 | custom build used by Asian government entities |
- 1.Hunt for the named CAB under Windows\SoftwareDistribution\Download and the listed NetamLoader detections.
- Vendors
- Microsoft
- Products
- Windows 10Patch My PC
- Malware
- NetamLoaderZapchast
- Organizations
- Kaspersky
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | e4537a1762fcafd2fd96bfc825bad34f9db9a24d | ssemblies. The file was compressed into a CAB archive named e4537a1762fcafd2fd96bfc825bad34f9db9a24d and saved in the folder that stores Windows operating syste |
From the original article
13 min read at securelist.com
Kaspersky researchers analyze a complex targeted attack employing NetamLoader, a sophisticated malicious framework and targeting a customized government OS.
By GReAT · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.