Kaspersky Details NetamLoader XAML Chain Targeting Custom Asian Government Windows Build

Summary

Kaspersky detailed NetamLoader, a multi-stage .NET/XAML loader that abuses deserialization and AMSI, runs through a Patch My PC process, and communicates with C2. KSN telemetry showed one Asian victim; attribution remains unknown.

Key points

Kaspersky traced the infection chain from a CAB archive in the Windows update-download directory; it did not determine how the archive reached the victim.
A crafted .config file and fabric.config trigger AppDomainManager loading, BinaryFormatter deserialization, a TypeConfuseDelegate attack, and successive XAML payloads.
The loader hijacks the AMSI scan path, disables .NET ETW provider registration, and moves execution into dllhost.exe through a remote COM object.
The malware removes files, logs, Prefetch data, and registry records to hinder forensic analysis.
The .NET plugin gathers Windows and .NET version information, detects system proxies, and communicates with openaigpt4v[.]com using AES-CBC with HMAC.
The configured malware delays its first C2 connection by 20–40 minutes and polls at long intervals when the server does not respond.
KSN telemetry identified one victim in Asia. Kaspersky inferred government targeting from the customized Windows build, but did not establish how the malware was delivered or attribute it to a known APT group.

Article Details

Attack Vectors: The CAB archive’s delivery method was not observed. Its placement in the Windows update package directory and the infection chain led researchers to say a supply-chain attack was strongly indicated; the suspected target was a customized government-only Windows build in Asia.
PatchMyPC-ScriptRunner.exe loads an assembly through AppDomainManager injection using its accompanying configuration file. A crafted fabric.config loads Resources.resx, whose serialized payload triggers BinaryFormatter deserialization and a TypeConfuseDelegate chain that parses embedded XAML.
The framework decodes, decompresses, and decrypts layered XAML and .NET payloads, then uses RPC/COM and an object-deserialization exploit to load XAML-3 into dllhost.exe.
XAML-2-1 patches the AMSI scan method so scans return AMSI_RESULT_CLEAN. The loader also sets COMPlus_ETWEnabled to 0 to prevent CLR ETW provider registration.
The .NET 2 Plugin communicates with its C2 server over HTTPS, encrypts traffic using AES-128-CBC with HMAC, discovers system proxy settings, and retrieves XAML payloads. It delays the initial C2 connection by 20–40 minutes.
Defensive Notes: Kaspersky products detect the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*.
The loader removes stage-one files, CLR usage logs, Prefetch files, and update-related records, and filters Windows log files for lines containing GetExtendedUpdateInfoHandler.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`openaigpt4v[.]com`	Domain identified in the article as the malware’s C2 server.
MD5	`4f28622c5e60c01319bf48cf742fe1a5`	Hash of XAML-2-2, which loads the .NET 1 Loader and C2 configuration.
MD5	`514117d536e347560d049cfe0c609632`	Hash of XAML-1, a loader in the malicious infection chain.
MD5	`514ac0d73b8a1b73488ef5e2e55a75c3`	Hash of PatchMyPC-ScriptRunner.exe.config, used to trigger AppDomainManager injection.
MD5	`67e3617f8709d34f806f8e02badba8a5`	Hash of fabric.config, which is crafted to load the malicious Resources.resx content.
MD5	`9000820d8153c24cd60d53001d3a97b6`	Hash of XAML-2, which initiates stage 2 of the infection.
MD5	`ab81564bcb8ca7e710c66832de747556`	Hash of the .NET 1 Loader component of the malicious framework.
MD5	`b3c4a635179680edafb5d006cf0cffc6`	Hash of XAML-2-1, which patches AMSI scanning.
MD5	`c86d53392a87dd3f3e62d62c9b92a9bd`	Hash of XAML-3, the payload loaded into dllhost.exe.
MD5	`cfb8b281bdf5d9390e64b10c312fb2c1`	Hash of the .NET 2 Plugin loaded by the malicious framework.
MD5	`e1dc6f1ed193594f2284be22ae08dfa4`	Hash of Resources.resx, which contains the serialized payload used in the infection chain.
MD5	`f2458ed133f8d0ca19e22c10f577e98e`	Hash listed for the CAB archive found in the Windows update download directory.
URL	`hxxps[:]//openaigpt4v[.]com/model_v4/94aafd58-c00c-402a-aae6-858b4486a1a4?b=lM4V3VwrWtXBy4oBGUkXOHfxyLUlrT2hIZGn4C37W1Z3%2FeW1WURJqzaNLQhGFHsWxA2lpJHZSpd8VDLMOQRD%2FfsDswnomIrBpoaNzug3dOtrh1J2KIqZRmKx1TtQsxq1RAGu1y45rSKaPHm9s2HF8A%3D%3D&c=41bd7f37-c3f6-4a9e-b2f3-5363e9a2c095`	Specific C2 polling URL shown in the article as the malware’s final HTTP request URL.