SecureLeaf has tracked the Omegatech ClickFix/EtherHiding cluster from V1 through V11. V11 uses the compromised legitimate site splitcam.com as its lure and delivers the same DonutLoader end-stage seen in V7–V10. Two material changes this version: the blockchain-hosted stage moved from BSC mainnet to BSC testnet, and the second-stage path was renamed to /my_enterprise/. Backend delivery infrastructure remains constant on 158.94.208.0/24, which keeps V11 firmly attached to the prior cluster.
Confirmation is drawn from two tria.ge detonations (win11 + win10) and a behavioral PCAP. The win10 run additionally exposes the persistence arm (Task Scheduler COM) that the win11 run did not reach.
| Dimension | V7–V10 | V11 (this advisory) |
|---|---|---|
| Lure vector | compromised WordPress hosts | compromised splitcam.com (CF-fronted) |
| EtherHiding chain | BSC mainnet | BSC testnet (publicnode + prebsc seed:8545) |
| Stage-2 path | (prior paths) | /my_enterprise/ |
| Delivery infra | 158.94.208.0/24 | 158.94.208.0/24 (unchanged) |
| End-stage | DonutLoader → svchost | DonutLoader → svchost (unchanged) |
REPORTABLE high-confidence malicious · DO-NOT-BLOCKLIST compromised/abused-legitimate · FINGERPRINT cluster signal
| Indicator | Value | Role | Class |
|---|---|---|---|
| Cradle / beacon IP | 158.94.208.92 (80,443) | ClickFix stage-2 retrieval; = digitalenterprise2026.com | REPORTABLE |
| Stage-2 host | 158.94.208.104 (80) | cleartext nginx payload host (/my_enterprise/) | REPORTABLE |
| TDS | 178.16.53.137 (NL) | dntds.shop — primary payload host; 31.58 MB over TLS/443 (PCAP) | REPORTABLE |
| TDS-adjacent | 178.16.53.43 (80) | same /24, cleartext contact | REPORTABLE |
| Aux C2 | 91.92.243.161:3038 | odd-port callback — CONFIRMED active (13 pkts, cleartext custom proto, PCAP) | REPORTABLE |
| Domain | dntds.shop | TDS | REPORTABLE |
| Domain | digitalenterprise2026.com | beacon/cradle (158.94.208.92) | REPORTABLE |
| Lure host | splitcam.com | compromised victim (CF-fronted) | DO-NOT-BLOCKLIST |
| BSC testnet RPC | bsc-testnet-rpc.publicnode.com (104.20.24.117 / 172.66.150.162) | abused legitimate (EtherHiding, TLS/443 — channel actually used) | DO-NOT-BLOCKLIST |
| BSC testnet seed | data-seed-prebsc-1-s1.binance.org:8545 | abused legitimate — NOT contacted in PCAP (no :8545 traffic) | DO-NOT-BLOCKLIST |
| Benign noise (excluded) | 92.223.97.79 | msedge.b.tlu.dl.delivery.mp.microsoft.com (MS BITS / Akamai) — do NOT report | DO-NOT-BLOCKLIST |
| URL | Stage |
|---|---|
| http://158.94.208.92/?sid=<epochms>-<rand> | ClickFix cradle |
| http://158.94.208.104/my_enterprise/ | stage-2 landing (301 from /my_enterprise) |
| http://158.94.208.104/enterprise/my_s.bin | Donut shellcode |
| http://158.94.208.104/enterprise/my_downloader.bin | downloader |
| File | SHA-256 |
|---|---|
| mc5z3xll.dll | 85aceb0cf14b0c6dc327df2939d2922e71b3169dca5078708249d534c0a409e1 |
| mc5z3xll.0.cs | f08c2ad3bf501e5dc9aa4f271d1f81aa286af3cdc63358fbddf1592c43cb74a1 |
| mc5z3xll.cmdline | c7b3b1f009b26e0c03101f3ac7a52d27b83c48ad3ca3ea4de33da68cb8c81729 |
| my_s.bin (served, MZER-polyglot Donut shellcode, 284160B) | c835f1a1da7a3c22e92e1d0a8d6781fbd77f9016fb431e2c71d8dbe7c6295253 |
| /my_enterprise/ body (53323B, shellcode-like) | 1957217fe2e5b5fd4ff13dd166aed003f70756c7d8ac0edd966086db789c2533 |
| ClickFix cradle page (158.94.208.92, 1697B) | a3147e729a5e9c10071197463588c4d55381ccc1c1b10d6ad92af6c64594185c |
| [mem] Donut region PID792 (MZER@0x0, 286720B) — volatile/corroboration | 1db7a1acc730afe86772cc56cab90d161c6ce8a33efb14b0c592bba741077f49 |
| [mem] loader working-mem PID936 (holds contract+UA+seed) — volatile/corroboration | 80860399af45d0ce5861cf18d7d56da6cce42c42608047e39e1e844c8b638a2e |
FINGERPRINT Correction (V11.2): the sesame-open-yourself UA was not observed in the full PCAP (0 hits) and is unconfirmed for V11. The stage-2 retrieval UAs actually seen are bare powershell (for my_s.bin) and Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.4046 (cradle + /my_enterprise[/]). Pivot on those.
FINGERPRINT Reconciliation (V11.2): memory forensics show sesame-open-yourself is compiled into the loader (10 hits, PID 936 string table). It is a genuine kit string that was simply not emitted on the wire in the da400bb8 run. Status: unconfirmed → confirmed-in-loader (run-dependent emission). See §11.
FINGERPRINT MZER prologue. Served stage payloads open with 4D 5A 45 52 (“MZER”) immediately followed by a GetPC stub (E8 00 00 00 00 59 48 83 E9 09). This polyglot header is observed across the V-series and is a far stronger cluster signal than a bare MZ match. Anchor detection at file offset 0.
| Tactic | Technique | Observed |
|---|---|---|
| Initial Access | T1189 | Drive-by via compromised splitcam.com |
| Command & Control | T1659 | Content injection / EtherHiding (BSC testnet) |
| Execution | T1204.004 | ClickFix copy-paste user execution |
| Execution | T1059.001 | PowerShell cradle |
| Defense Evasion | T1027.004 | Compile-after-delivery (csc.exe/cvtres.exe) |
| Defense Evasion | T1140 | obfuscator.io + RC4 loader decode |
| Defense Evasion / Execution | T1620 | Reflective code loading (Donut) |
| Privilege Esc. / Def. Evasion | T1055 | WriteProcessMemory → svchost.exe |
| Persistence | T1053.005 | Task Scheduler COM (win10) |
| Discovery | T1217 / T1012 / T1082 / T1124 | browser / registry / system info / time |
· powershell.exe spawning csc.exe/cvtres.exe then writing to svchost.exe.
· Outbound TLS to bsc-testnet-rpc.publicnode.com from a browser child process (testnet EtherHiding; :8545 not used this campaign run).
· HTTP requests with UA sesame-open-yourself.
· Any contact to 158.94.208.0/24 or /my_enterprise/.
· Block reportable IPs/domains (§4.1); spare CF/Binance/legit infra.
· Remove Task Scheduler COM persistence (win10 arm).
· Submit reportable hosts to AbuseIPDB/OTX under handle Dispensight.
· Notify splitcam.com operators (compromised victim).
rule Omegatech_MZER_Donut_Prologue
{
meta:
author = "Dispensight (SecureLeaf)"
advisory = "SL-ADV-2026-WP-001 (V11.2)"
description = "MZER polyglot header + GetPC stub on served stage payloads"
reference = "any.run da400bb8; my_s.bin c835f1a1...295253"
tlp = "CLEAR"
strings:
// 'MZER' (self-cancelling reg ops) -> call $+5 -> pop rcx -> sub rcx,9
$mzer_getpc = { 4D 5A 45 52 E8 00 00 00 00 59 48 83 E9 09 }
condition:
$mzer_getpc at 0
}Header-anchored; low FP. Tighten/loosen by trimming the trailing 48 83 E9 09 if blob alignment shifts across versions.
Source: 53 MB behavioral capture, victim 192.168.100.4 / DESKTOP-JGLLJLD (win10 19045), 183 s, 60,174 packets. any.run task da400bb8.
| Claim in V11 | PCAP finding | Disposition |
|---|---|---|
| Stage-2 UA sesame-open-yourself | 0 occurrences; real UAs = powershell / WindowsPowerShell/5.1.19041.4046 | CORRECTED |
| EtherHiding via cleartext :8545 + prebsc seed | 0 packets to :8545; seed never resolved/contacted; RPC = publicnode over TLS/443 | CORRECTED |
| my_s.bin = shellcode | served blob opens 4D 5A 45 52 (‘MZER’) + GetPC stub = polyglot Donut shellcode, NOT a PE; the 53323B /my_enterprise/ body is a second shellcode blob (0xE8) | CORRECTED |
| 178.16.53.137 = TDS | 31.58 MB delivered over TLS/443 — primary encrypted payload host | UPGRADED |
| 91.92.243.161:3038 aux C2 | CONFIRMED active: 13 pkts, cleartext custom binary proto (not TLS) | CONFIRMED |
| Per-victim sid tracking | new instance 1782706624767-sfjppp33 → click time 2026-06-29 04:17Z | CONFIRMED |
| my_downloader.bin / _zip_ blob / 178.16.53.43 | not exercised in this run (absence ≠ benign) | UNOBSERVED |
| 92.223.97.79 (candidate) | = msedge MS-BITS/Akamai delivery — benign | EXCLUDED |
DNS confirmations: dntds.shop → 178.16.53.137; digitalenterprise2026.com → 158.94.208.92 (SNI-confirmed); splitcam.com → 104.21.39.190 / 172.67.148.86 (CF). EtherHiding contract address is not recoverable — the publicnode RPC channel is TLS-encrypted.
· tria.ge behavioral (win11): 260627-xsnlysdt3q
· tria.ge behavioral (win10): 260627-xzmcgacz4x
· STIX 2.1 bundle: SL-ADV-2026-WP-001_V11.stix.json (TAXII: taxii.dispensight.ca)
· any.run behavioral PCAP: da400bb8-b2d8-4c93-9e10-17ffb7a7166f
· STIX 2.1 bundle (enriched): SL-ADV-2026-WP-001_V11.1_stix.json
· AbuseIPDB bulk report: SL-ADV-2026-WP-001_V11.1_abuseipdb.csv (4 PCAP-observed hosts)
· Prior cluster: SL-ADV-2026-WP-001 V1–V10
| Version | Date | Change |
|---|---|---|
| V11.2 | 2026-06-29 | Memory-forensics enrichment (splitcam-memdump). Recovered the EtherHiding contract 0xa44DFB63dd4937983195c80d83387a10567496FC from loader memory (closes V11.1 §8 gap). Reconciled sesame-open-yourself UA (unconfirmed → confirmed-in-loader, run-dependent emission). prebsc seed config-resident but not contacted. Backend constancy + MZER@0x0 re-confirmed from memory. Added memory-region corroboration hashes (volatile). See §11. |
| V11.1 | 2026-06-29 | Full-PCAP validation (any.run da400bb8). Corrections: (a) sesame-open-yourself UA not observed — real fetch UAs are powershell / WindowsPowerShell/5.1.19041.4046; (b) EtherHiding ran over TLS to bsc-testnet-rpc.publicnode.com, not cleartext :8545 (prebsc seed never contacted); (c) my_s.bin re-characterized from “PE/MZ” to MZER-polyglot Donut shellcode (GetPC stub). Upgrades: 178.16.53.137 → primary encrypted payload host (31.58 MB TLS). Additions: served-payload SHA-256s, Omegatech_MZER_Donut_Prologue YARA rule, aux-C2 91.92.243.161:3038 confirmation, new cradle sid instance. Excluded 92.223.97.79 (MS BITS/Akamai, benign). 178.16.53.43 / my_downloader.bin / _zip_ blob not exercised this run. |
| V11 | 2026-06-27 | Initial V11. New lure splitcam.com (CF-fronted); EtherHiding moved BSC mainnet → testnet; stage-2 path renamed /my_enterprise/; backend constant on 158.94.208.0/24; DonutLoader end-stage unchanged. Two tria.ge detonations (win11 + win10). |
| V1–V10 | prior | Omegatech ClickFix/EtherHiding cluster tracking: JS loader deobfuscation, STIX/TAXII maintenance, AS202412 (Omegatech LTD) attribution, ColocaTel AS213438 structural twin, mid-investigation retraction SL-RETRACT-2026-001. See prior advisories. |
Source: splitcam-memdump (Recorded Future sandbox, 34 region dumps across PID 792/936/1116/5272, 2026-06-29). Static analysis only — no payload bytes reproduced; indicators key on memory-resident strings/hashes.
| Finding | Disposition |
|---|---|
| sesame-open-yourself UA | Compiled into loader (10 hits, PID 936); NOT wire-emitted in da400bb8. unconfirmed → confirmed-in-loader (run-dependent). |
| prebsc seed data-seed-prebsc-1-s1.binance.org:8545 | Config-resident in memory but not contacted — consistent with PCAP. Presence in config ≠ contacted. |
| EtherHiding contract 0xa44DFB63dd4937983195c80d83387a10567496FC | RECOVERED from loader memory — closes the V11.1 §8 “not recoverable” gap. |
| Backend constancy (158.94.208.104, my_s.bin, my_downloader) | Re-confirmed from memory, independent of PCAP. |
| MZER polyglot prologue | Present at offset 0 in PID 792 (286720B region) & PID 936 — second evidence source for the Donut payload. |
Caveat: memory-region SHA-256s are volatile (per-snapshot) — provided as corroboration/provenance, not durable blocklist IOCs. The contract address and UA string are the durable additions.