Omegatech EtherHiding
ClickFix V9

rule SecureLeaf_Omegatech_CSharp_PInvoke_Loader_V8V9 {
    meta:
        description = "Omegatech ClickFix C# loader V8+V9 - Tier-1 dev fingerprint"
        author      = "SecureLeaf / Dispensight"
        date        = "2026-06-10"
        reference   = "SL-ADV-2026-WP-001-V9"
    strings:
        $valloc  = "VirtualAlloc(IntPtr a, uint sz, uint t, uint p)" ascii
        $cthread = "CreateThread(IntPtr ta, uint ss, IntPtr sa, IntPtr p, uint cf" ascii
        $wfso    = "WaitForSingleObject(IntPtr h, uint ms)" ascii
        $interop = "System.Runtime.InteropServices" ascii
        $kernel  = "kernel32.dll" ascii
    condition:
        $interop and $kernel and $valloc and $cthread and $wfso
}

rule SecureLeaf_Omegatech_V9_JS_Beacon {
    meta:
        description = "Omegatech V9 injected JS beacon prefix in hijacked tracker"
        author      = "SecureLeaf / Dispensight"
        date        = "2026-06-10"
        reference   = "SL-ADV-2026-WP-001-V9"
    strings:
        $iconnode = "process.iconnode.com/google-ads/" ascii
        $verif    = "p.ksrndkehqnwntyxlhgto.com/verification/" ascii
        $flag1    = "phbqslixugkynefhnzol" ascii
        $flag2    = "yrejzpicqjfxoquxuuaw" ascii
        $wc_id    = "wc_profile_id" ascii
    condition:
        ($iconnode or $verif) and ($flag1 or $flag2) and $wc_id
}