Top Highlights
- NetamLoader appears to target a custom Windows build used by Asian government entities; delivery vector remains unknown.
- It chains signed .NET components, malicious configuration and layered XAML to load payloads, then bypasses AMSI and shifts execution into
dllhost.exe. - It erases update and forensic traces, delays C2 contact, and uses encrypted communications to fetch further XAML payloads.
Threat, attack techniques, and targets
– Researchers identified NetamLoader, a complex .NET loading framework. They have not linked it to a known APT group.
– The attack chain abuses AppDomainManager injection, .NET deserialization, and XAML to load encrypted payloads in memory. It also hijacks AMSI to bypass malware scanning. Researchers did not observe how attackers delivered the initial CAB archive.
– The malware targets a customized Windows 10 build intended for government use in Asia. Kaspersky telemetry identified one victim in Asia. However, the evidence does not confirm the full scope of targeting.
Impact, security implications, and remediation
– NetamLoader can hide activity, erase system and execution records, collect system details, and communicate with a C2 server. It also runs payloads in dllhost.exe, which can make detection and investigation harder. The source does not confirm what further actions the payload performs.
– The reported C2 domain is openaigpt4v[.]com. Therefore, security teams should review network and endpoint activity for related indicators and investigate signs of altered update records or cleared logs.
– The source provides no remediation steps. Obtain current guidance from the relevant security vendor or government cybersecurity authority.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
