SecureLeaf Threat Advisory · Dispensight CTI

Omegatech ClickFix → EtherHiding → DonutLoader — Version 11 (lure: splitcam.com)

BSC-testnet EtherHiding · in-memory C# compile · Donut shellcode → svchost.exe
Severity: Critical Advisory: SL-ADV-2026-WP-001 (V11) Family: DonutLoader tria.ge score: 10/10 Published: 2026-06-27 TLP: CLEAR

1. Executive summary

SecureLeaf has tracked the Omegatech ClickFix/EtherHiding cluster from V1 through V11. V11 uses the compromised legitimate site splitcam.com as its lure and delivers the same DonutLoader end-stage seen in V7–V10. Two material changes this version: the blockchain-hosted stage moved from BSC mainnet to BSC testnet, and the second-stage path was renamed to /my_enterprise/. Backend delivery infrastructure remains constant on 158.94.208.0/24, which keeps V11 firmly attached to the prior cluster.

Confirmation is drawn from two tria.ge detonations (win11 + win10) and a behavioral PCAP. The win10 run additionally exposes the persistence arm (Task Scheduler COM) that the win11 run did not reach.

2. TTP evolution vs V7–V10

DimensionV7–V10V11 (this advisory)
Lure vectorcompromised WordPress hostscompromised splitcam.com (CF-fronted)
EtherHiding chainBSC mainnetBSC testnet (publicnode + prebsc seed:8545)
Stage-2 path(prior paths)/my_enterprise/
Delivery infra158.94.208.0/24158.94.208.0/24 (unchanged)
End-stageDonutLoader → svchostDonutLoader → svchost (unchanged)

3. Kill chain

  1. Victim browser loads splitcam.com (compromised; Cloudflare-fronted 172.67.148.86 / 104.21.39.190), which serves an obfuscator.io + RC4 loader.
  2. Loader issues a BSC testnet eth_call via bsc-testnet-rpc.publicnode.com and data-seed-prebsc-1-s1.binance.org:8545 to read the hidden contract (EtherHiding).
  3. ClickFix UI tricks the user into pasting a PowerShell one-liner that fetches the cradle: GET http://158.94.208.92/?sid=<epoch-ms>-<rand>.
  4. Cradle sets stage-2 base http://158.94.208.104/my_enterprise → 301 → /my_enterprise/ (cleartext nginx).
  5. Stage-2 pulls /enterprise/my_s.bin (shellcode) and /enterprise/my_downloader.bin (downloader), plus a hex-named …_zip_… blob.
  6. PowerShell compiles C# in memory: csc.exe → cvtres.exe → mc5z3xll.dll.
  7. Donut shellcode is reflectively loaded and injected via WriteProcessMemory into svchost.exe (win11). On win10, Task Scheduler COM establishes persistence.
Telemetry note. The sid token is <epoch-ms click time>-<rand> — observed value 1782587888594-4xwumw3z decodes to the detonation click time, confirming per-victim tracking fires end-to-end.

4. Indicators of Compromise

REPORTABLE high-confidence malicious · DO-NOT-BLOCKLIST compromised/abused-legitimate · FINGERPRINT cluster signal

4.1 Network infrastructure

IndicatorValueRoleClass
Cradle / beacon IP158.94.208.92 (80,443)ClickFix stage-2 retrieval; = digitalenterprise2026.comREPORTABLE
Stage-2 host158.94.208.104 (80)cleartext nginx payload host (/my_enterprise/)REPORTABLE
TDS178.16.53.137 (NL)dntds.shop DonutLoader TDSREPORTABLE
TDS-adjacent178.16.53.43 (80)same /24, cleartext contactREPORTABLE
Aux C291.92.243.161:3038odd-port callbackREPORTABLE
Domaindntds.shopTDSREPORTABLE
Domaindigitalenterprise2026.combeacon/cradle (158.94.208.92)REPORTABLE
Lure hostsplitcam.comcompromised victim (CF-fronted)DO-NOT-BLOCKLIST
BSC testnet RPCbsc-testnet-rpc.publicnode.comabused legitimate (EtherHiding)DO-NOT-BLOCKLIST
BSC testnet seeddata-seed-prebsc-1-s1.binance.org:8545abused legitimate (EtherHiding)DO-NOT-BLOCKLIST

4.2 URLs / paths

URLStage
http://158.94.208.92/?sid=<epochms>-<rand>ClickFix cradle
http://158.94.208.104/my_enterprise/stage-2 landing (301 from /my_enterprise)
http://158.94.208.104/enterprise/my_s.binDonut shellcode
http://158.94.208.104/enterprise/my_downloader.bindownloader

4.3 Host artifacts (hashes)

FileSHA-256
mc5z3xll.dll85aceb0cf14b0c6dc327df2939d2922e71b3169dca5078708249d534c0a409e1
mc5z3xll.0.csf08c2ad3bf501e5dc9aa4f271d1f81aa286af3cdc63358fbddf1592c43cb74a1
mc5z3xll.cmdlinec7b3b1f009b26e0c03101f3ac7a52d27b83c48ad3ca3ea4de33da68cb8c81729

4.4 Behavioral fingerprint

FINGERPRINT Custom stage-2 fetch User-Agent: sesame-open-yourself — non-standard, links V11 retrieval traffic to prior cluster activity. Pivot on this across historical captures.

Prefix correlation. 158.94.208.92 and 158.94.208.104 both sit in 158.94.208.0/24. Run against the AS202412 (Omegatech LTD) prefix-match rule — a hit is another structural-twin confirmation and elevates attribution confidence.
Reconciliation. The empty-string SHA-256 e3b0c44…b855 appears legitimately as the zero-length crashpad pipe and must not be conflated with the decoy challengeHash in the loader's ClickFix insert.

5. MITRE ATT&CK

TacticTechniqueObserved
Initial AccessT1189Drive-by via compromised splitcam.com
Command & ControlT1659Content injection / EtherHiding (BSC testnet)
ExecutionT1204.004ClickFix copy-paste user execution
ExecutionT1059.001PowerShell cradle
Defense EvasionT1027.004Compile-after-delivery (csc.exe/cvtres.exe)
Defense EvasionT1140obfuscator.io + RC4 loader decode
Defense Evasion / ExecutionT1620Reflective code loading (Donut)
Privilege Esc. / Def. EvasionT1055WriteProcessMemory → svchost.exe
PersistenceT1053.005Task Scheduler COM (win10)
DiscoveryT1217 / T1012 / T1082 / T1124browser / registry / system info / time

6. Detection & response

Hunt

· powershell.exe spawning csc.exe/cvtres.exe then writing to svchost.exe.
· Outbound :8545 JSON-RPC eth_call from a browser child process.
· HTTP requests with UA sesame-open-yourself.
· Any contact to 158.94.208.0/24 or /my_enterprise/.

Respond

· Block reportable IPs/domains (§4.1); spare CF/Binance/legit infra.
· Remove Task Scheduler COM persistence (win10 arm).
· Submit reportable hosts to AbuseIPDB/OTX under handle Dispensight.
· Notify splitcam.com operators (compromised victim).

7. References

· tria.ge behavioral (win11): 260627-xsnlysdt3q
· tria.ge behavioral (win10): 260627-xzmcgacz4x
· STIX 2.1 bundle: SL-ADV-2026-WP-001_V11.stix.json (TAXII: taxii.dispensight.ca)
· Prior cluster: SL-ADV-2026-WP-001 V1–V10