Omegatech ClickFix / EtherHiding / DonutLoader

01

Summary

The cluster tracked since V8 as “Omegatech ClickFix” continues under the same kill chain: a compromised website reads a base64 JavaScript payload out of a BNB-Smart-Chain testnet smart contract (EtherHiding), presents a fake-verification ClickFix lure that pastes a PowerShell cradle, compiles a C# stub in memory (csc.exe/cvtres.exe), and runs a two-stage MZER-polyglot Donut loader that injects into svchost.exe and persists via a Task Scheduler COM object.

What is materially new in V13.1.2 is structural, not mechanical: the operator now runs two parallel delivery branches — a root template and a /std/ template — that share one C2 IP and one payload host but keep separate beacon domains, separate payload-host domains, and separate EtherHiding contracts. The branches are segregated down to the blockchain layer. Four lures detonated within a ~9-minute window on 2026-08-01 resolve cleanly into this one wave.

02

Kill chain

Identical across both branches; only the paths, domains, and contract differ.

03

Anchors vs. rotation

The operator recompiles the loader within about a minute of each victim hitting the cradle, which kills per-sample SHA-256 as a pivot. Track the invariants instead.

04

Two operationally-segregated branches

Both branches ride the same C2 IP (158.94.211.92, AS202412) and the same payload host (178.16.53.137, NL), but are otherwise parallel — including a distinct EtherHiding contract each.

05

What's new versus earlier families

A calibrated diff against prior versions of the same cluster. Only genuine deltas are listed.

Consistent with prior versions (not new): the MZER polyglot header with GetPC bootstrap, the Donut/CLR-hosting architecture, the ClickFix→PowerShell→csc.exe in-memory compile, svchost injection, Task Scheduler COM persistence, BSC-testnet (not mainnet) EtherHiding, and the ipinfo.io geolocation check.

06

Detonations — 2026-08-01

Four samples, one wave. sid values are per-victim epoch-ms tokens; each decodes to its own detonation minute, confirming live per-victim tracking. All lure hosts are compromised victims.

07

Indicators

Rotation-proof — lead with these

Network — AS202412 & payload infrastructure

Behavioural

08

Do-not-blocklist

09

MITRE ATT&CK

10

Detection

Full ruleset ships alongside this advisory as SL-ADV-2026-WP-001-V13.1.2.yar (6 rules) and …stix2.json. Highest-fidelity anchors:

• Loader family — MZER + GetPC prologue at offset 0: 4D 5A 45 52 E8 00 00 00 00 59 48 83 E9 09 48 8B (catches both stages, both branches).
• Stage discrimination — mscoree/CorBindToRuntime/.fptable → loader; WinHttp*/CreateRemoteThread → downloader.
• C2 canary — regex handleCmdCheck_[0-9]{10,}_[0-9]{1,4}\(\{"executed":(true|false)\}\) in proxy logs or process memory.
• EtherHiding — eth_call + selector 0x6d4ce63c, or either branch contract literal, in TLS-inspected or memory data.

Verified: the loader rule matched the CLR-host stages carved from both martvarauto.ee and besen-group.com; the downloader rule matched the WinHTTP stage from munis-minibus.com and both /std/ lures — with clean separation between the two.