Omegatech EtherHiding
ClickFix V9
Infrastructure rotation of V8 introducing separated beacon/payload stages, renamed payload paths
(student_*.bin),
and a C# P/Invoke stub with tid→sid YARA evasion. Lure site: compromised UK CCTV business
williamhale.co.uk. Note: three indicators originally attributed to this campaign
have been retracted — they belong to WhatConverts, a legitimate SaaS platform that was
coincidentally installed on the victim site.
The original V9 advisory (2026-06-10) attributed three domains to the Omegatech ClickFix campaign. Following vendor response and fresh PCAP re-analysis, SecureLeaf has determined these indicators were incorrectly attributed and has retracted them. They belong to WhatConverts (whatconverts.com), a legitimate SaaS lead-tracking platform serving over 20,000 businesses.
The mistake was understandable in context: both the WhatConverts tracking script and the
Omegatech ClickFix injector were present on the same compromised WordPress page
(williamhale.co.uk), and WhatConverts' domain naming conventions —
s.ksrndkehqnwntyxlhgto.com, p.ksrndkehqnwntyxlhgto.com,
process.iconnode.com — are deliberately designed to resemble random strings
in order to evade ad blockers, which produces a fingerprint indistinguishable from
threat actor CDN infrastructure to an outside observer. A reasonable analyst mistake.
That said, the error is ours, and we are correcting it fully.
The definitive evidence is chronological:
WhatConverts fires on page load, nearly 5 seconds before the Omegatech
ClickFix payload arrives from dntds.shop. Static analysis of the
VM50 ClickFix loader (SHA256:
f253e505...356e45) confirmed zero references to any
WhatConverts domain — not even encoded or hex-escaped. The two systems are entirely
independent occupants of the same compromised page.
WhatConverts' technical explanations of the flagged behaviors are accurate:
process.iconnode.com/google-ads/ is an ad-blocker detection endpoint
(the path is intentionally named to be blocked, which toggles a detection flag);
p.ksrndkehqnwntyxlhgto.com/verification/ is a customer-initiated
script install check. Both behaviors are documented publicly in their WordPress
plugin listing and help documentation. AWS Trust & Safety confirmed no malicious
activity on their infrastructure after engaging with WhatConverts directly.
<script> tag loads VM50 ClickFix loader from attacker-controlled path.s.ksrndkehqnwntyxlhgto.com/137116.js) also loads — legitimately installed by site owner, unrelated to Omegatech. The injected 1,254-char prefix on that script file is a separate Omegatech injection into the WhatConverts customer's script instance.bsc-testnet-rpc.publicnode.com to retrieve the next-stage payload URL from a BNB Smart Chain smart contract. URL is never hardcoded in the lure JS.dntds.shop/teamrepo?rnd=<float>&ts=<unix_ms>. V9 path change: /teamrepo (V8 used /jsrepo). Resolves to 178.16.53.137:443.iex(irm '91.92.240.121/...'). Stage-2 PS loader retrieved from C2.Add-Type to compile C# P/Invoke stub (zgxr4teh_0.cs) via csc.exe into zgxr4teh.dll in %TEMP%.http://158.94.208.104/x7GkP2mQ9zL4/student_s.bin — PE shellcode (~305 KB). V9 rename from my_s.bin (V8), evading /my_*\.bin YARA signatures.http://158.94.208.104/x7GkP2mQ9zL4/student_l.bin — staging blob (~52 KB, served as image/png). V9 rename from my_newest_ll.png./x7GkP2mQ9zL4/ identical to V8 — same Tier-1 staging operator confirmed.zgxr4teh.dll) called from PS runspace: VirtualAlloc → shellcode copy → CreateThread → WaitForSingleObject.svchost.exe CDPUserSvc instance. Donut loader attribution confirmed across V8+V9 via 8/8 static indicators.tid→sid. Tier-1 dev fingerprint (abbreviated param names) preserved across both variants.svchost.exe establishes persistent connection to 91.92.243.161:3038. Non-standard port, MSIL/Generic activity confirmed by sandbox.| Component | V8 | V9 |
|---|---|---|
| Lure site | penrosept.com (PT clinic, USA) | williamhale.co.uk (CCTV, UK)NEW |
| TDS path | /jsrepo?rnd= | /teamrepo?rnd=NEW |
| TDS host | dntds.shop → 178.16.53.137 | dntds.shop → 178.16.53.137 (unchanged) |
| PS C2 IP | 158.94.208.92 | 91.92.240.121ROTATED |
| RAT C2 IP | 158.94.208.104 | 91.92.243.161:3038ROTATED |
| Staging server | 158.94.208.104 | 158.94.208.104 (unchanged) |
| Staging path | /x7GkP2mQ9zL4/ | /x7GkP2mQ9zL4/ (unchanged) |
| Payload names | my_s.bin / my_newest_ll.png | student_s.bin / student_l.binYARA EVASION |
| C# stub param | tid (WaitForSingleObject) | sidYARA EVASION |
| Loader filename | flferzre_0.cs / flferzre.dll | zgxr4teh_0.cs / zgxr4teh.dll |
| Donut loader | Confirmed (8/8 indicators) | Confirmed (inherited) |
| Tier-1 dev | Abbreviated P/Invoke params | Abbreviated P/Invoke params (same operator) |
| EtherHiding | bsc-testnet-rpc.publicnode.com | bsc-testnet-rpc.publicnode.com (unchanged) |
tid → sid
WaitForSingleObject thread handle parameter from tid to sid. This was a direct response to the V8 YARA rule published in SL-ADV-2026-WP-001-V8. The underlying technique is identical; the abbreviated parameter naming style (Tier-1 dev fingerprint) was preserved, confirming the same developer.student_*.bin
my_s.bin / my_newest_ll.png (V8) to student_s.bin / student_l.bin (V9). The /my_*\.bin URL pattern YARA signature from V8 would have caught V8 payloads; the rename evades it. The staging server IP and path prefix /x7GkP2mQ9zL4/ are unchanged, providing continued detection coverage.iconnode.com
RC4 obfuscation
AS202412
sid rename; also catches V8 tid variant via OR condition.rule SecureLeaf_Omegatech_V9_CSharp_Loader { meta: = = = = = strings: $va = "VirtualAlloc" ascii $ct = "CreateThread" ascii $wfso = "WaitForSingleObject" ascii $gcp = "GetCurrentProcess" ascii $sid = "uint sid" ascii // V9 renamed param $tid = "uint tid" ascii // V8 param (catches older variant) $dllim = "DllImport" ascii $kern = "kernel32" ascii condition: $va and $ct and $wfso and $gcp and $dllim and $kern and ($sid or $tid) }
student_* (V9) and my_* (V8) naming under the same path prefix.rule SecureLeaf_Omegatech_V9_Payload_URL { meta: = = = strings: $path = "/x7GkP2mQ9zL4/" ascii $student = "student_" ascii // V9 $my_ = "my_" ascii // V8 $bin = ".bin" ascii condition: $path and $bin and ($student or $my_) }
rule SecureLeaf_Omegatech_ClickFix_TDS { meta: = = = strings: $teamrepo = "/teamrepo?rnd=" ascii // V9 $jsrepo = "/jsrepo?rnd=" ascii // V8 $dntds = "dntds.shop" ascii condition: $dntds and ($teamrepo or $jsrepo) }
| Type | Value | Role / Notes |
|---|---|---|
| DOMAIN | dntds.shop | ClickFix TDS. V9 path: /teamrepo?rnd=. Resolves to 178.16.53.137. |
| IP | 178.16.53.137 | dntds.shop hosting IP. ClickFix JS delivery, port 443. |
| IP | 91.92.240.121 | V9 PS C2 check-in. AS202412, Spamhaus DROP 14+31. Replaces 158.94.208.92 (V8). |
| IP | 91.92.243.161 | V9 RAT C2, port 3038. AS202412. svchost CDPUserSvc post-injection beacon. |
| IP | 158.94.208.104 | Omegatech payload staging. /x7GkP2mQ9zL4/student_s.bin + student_l.bin. |
| URL | http://158.94.208.104/x7GkP2mQ9zL4/student_s.bin | V9 shellcode PE payload (~305 KB). V8 equivalent: my_s.bin. |
| URL | http://158.94.208.104/x7GkP2mQ9zL4/student_l.bin | V9 staging blob (~52 KB, served as image/png). V8 equivalent: my_newest_ll.png. |
| DOMAIN | bsc-testnet-rpc.publicnode.com | EtherHiding BSC RPC resolver. publicnode.com is legitimate; abused by Omegatech. |
| SHA256 | F833D7746ACC05A08F83A6BC17DF99CDBAB70ABD564B92870E4477B5D2CE451C | zgxr4teh_0.cs — V9 C# P/Invoke loader source. tid→sid YARA evasion. |
| SHA256 | 86C9D146201932FEB8D6B42161938F1C145C8989E7C753AAC876704D365724E9 | 137116.js — WhatConverts script with injected 1,254-char malicious prefix. WC platform itself is NOT malicious; only this injected version. |
| SHA256 | F253E50585499F3120E5E8842B58E1B0BD0883CF0DB7E1CA6FF2D718CA356E45 | VM50 — ClickFix lure JS (1.25 MB, RC4+base64 obfuscation). Zero WhatConverts domain references confirmed. |
| RETRACTED | s.ksrndkehqnwntyxlhgto.comRETRACTED | WhatConverts CDN. Legitimate SaaS platform. Fires t=5.27s on page load — 4.86s before dntds.shop. See Retraction section. |
| RETRACTED | p.ksrndkehqnwntyxlhgto.comRETRACTED | WhatConverts verification endpoint. Legitimate. See Retraction section. |
| RETRACTED | process.iconnode.comRETRACTED | WhatConverts ad-blocker detection endpoint. Legitimate. See Retraction section. |