Fake Marvell RAID Utility Uses Signed MSBuild to Load Malware

Nov 4, 2026 · Original article ↗

Summary

A fake Marvell RAID MSI uses renamed Microsoft-signed MSBuild and a tampered .NET library to decrypt and run a payload in memory, then downloads five DLL-sideloading kits. Researchers link its C2 to CNCMachineRMS by behavior, but have no code-level match.

Key points

The MSI masquerades as a Marvell RAID utility but installs no useful tool; it was signed with a newly issued certificate in an individual’s name.
Renamed Microsoft-signed MSBuild loads a tampered Microsoft.Data.Edm.dll, waits and checks for debuggers, then decrypts a 16.6 MB .NET payload into memory. A cleanup action removes the installer files after about five minutes.
The payload uses Google DNS-over-HTTPS and connects to kenpousland[.]cfd and crepiehumru[.]lol, both behind Cloudflare.
A modified wmp.dll with Control Flow Guard disabled is loaded from a temporary folder; the researchers say it is likely used for module stomping.
About 20 minutes after installation, the payload contacts 96.62.218[.]59 over a custom protocol and downloads five DLL-sideloading kits. The server matches one used by CNCMachineRMS, but the researchers have not confirmed the connection at code level.
The kits pair tampered DLLs with signed programs associated with MAGIX, ACD Systems, ASUS, NetEase, and VNG; the final payload families remain unknown.
Defensive advice includes alerting on MSBuild launched from user-writable folders or by msiexec, monitoring RunOnce cleanup entries, and looking for DLL sideloading and non-TLS traffic on port 443.

Article Details

Attack Vectors: A signed MSI posing as a Marvell RAID utility drops a renamed, Microsoft-signed MSBuild executable and a project file that loads a tampered Microsoft.Data.Edm.dll.
The loader checks for debuggers, delays execution for about 35–43 seconds, decrypts a .NET payload, and runs it in memory.
The payload loads a modified wmp.dll from a temporary folder and appears to overwrite its code in memory (module stomping).
The payload communicates with two domains over HTTPS and later uses a custom binary protocol on port 443 to contact 96.62.218[.]59 and download five DLL sideloading kits.
The kits pair signed applications with tampered DLLs. A later program, VHandler.exe, uploads about 2 MB to 93.152.220[.]219 and exchanges UDP packets with two additional servers.
A cleanup script uses hidden PowerShell and command-prompt processes to uninstall the MSI and remove dropped files; a RunOnce registry value is set as a fallback.
Defensive Notes: Alert when MSBuild.exe, including renamed copies identified by OriginalFileName, runs from user-writable folders or is launched by msiexec.exe.
Monitor for the environment variables CFG_SYSTEM_TASK_add8 and CFG_CONTEXT_PATH_0fa5, and RunOnce entries that launch msiexec /x … /qn after installation.
Look for system DLLs such as wmp.dll loaded from %TEMP%, especially when Control Flow Guard is disabled or the PE header checksum fails.
Hunt for signed applications running from %LOCALAPPDATA%\appdata, appspace, or appspace1, and for the listed suspicious C:\ProgramData folders.
Investigate non-TLS traffic on port 443 and MSBuild connections to public DNS-over-HTTPS resolvers.
The article advises obtaining driver and storage utilities from the vendor or PC maker and avoiding installers whose signature names an individual rather than the purported company.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`crepiehumru[.]lol`	Domain contacted by the payload over HTTPS as command-and-control infrastructure.
DOMAIN	`kenpousland[.]cfd`	Domain contacted by the payload over HTTPS as command-and-control infrastructure.
IPV4	`93[.]152[.]220[.]219`	Second-wave server contacted by VHandler.exe for an upload of about 2 MB over a custom protocol on port 443.
IPV4	`93[.]152[.]224[.]17`	Server that VHandler.exe exchanged UDP packets with on port 81.
IPV4	`94[.]26[.]41[.]43`	Server that VHandler.exe exchanged UDP packets with on port 81.
IPV4	`96[.]62[.]218[.]59`	Server contacted by the payload over a custom binary protocol on port 443; the article identifies it as the server used by CNCMachineRMS in an earlier case.
SHA256	`1e8a6a7f8605279f0e0479adbc6b7392705d093f7f8f5b8d7fd0f01651e1b254`	SHA-256 of the modified wmp.dll found in the payload's temporary folder; the article reports that it has Control Flow Guard data removed.
SHA256	`28392302b64af9777f23b2d44222bf584bbe66bf94f1d7c0c8147febe4f2cb07`	SHA-256 of the tampered webview_support.dll included in a DLL sideloading kit.
SHA256	`2cb6a818f929c3c175db6e7c39cb26c5bfc9f318e3f90493293af79bb2c2bc60`	SHA-256 of the tampered msadox.dll included in a DLL sideloading kit.
SHA256	`3500f12e1f73ff0bbeac8729130101d43c5a95cbff457e0562133f612063d889`	SHA-256 of the tampered Qt5Network.dll included in a DLL sideloading kit.
SHA256	`40881005ee0347d450ccf5bdb4aae2722536d603400d93b078d48bf091b0e579`	SHA-256 of the cleanup script dropped by the malicious installer.
SHA256	`5d2b86d5c438bef3eef38807de798a70f6c44fa3489dc9f21022a74a118136dc`	SHA-256 of the scrambled data file dropped with the malicious installer; the article says it is most likely payload configuration.
SHA256	`7131fb3e5d6999532430f630414116ffa69d8251350461e9a7d5f7618957baca`	SHA-256 of the encrypted payload resource associated with the malicious loader.
SHA256	`86b3cdcc9cf4f93d49e1a52f34c644b41bf0629c3390d7ec591ef4a97bc0cc15`	SHA-256 of the tampered Microsoft.Data.Edm.dll used as the loader.
SHA256	`8d55faa0a0a00f666a9c6e01bccf891d5669858238613e889801c29f0f952171`	SHA-256 of the project file used to invoke the malicious MSBuild task.
SHA256	`a86733c70d1eed6bbcd4e587ada4580289abc740187eb7cefff3b1a41b4d0434`	SHA-256 of the tampered WebView2Loader.dll identified in a DLL sideloading kit.
SHA256	`e4765f3d293f969916e61c756691868b1c8f530e7e00abffca16b95fec4fdcf4`	SHA-256 of the tampered vcomp140.dll that loads the malicious msadox.dll in a sideloading kit.
SHA256	`e98126909c5d2ea0d1f744ba7be5ff5ac6253f89e6468aa3594b3705813a4c66`	SHA-256 of the tampered AsusTPApi.dll included in a DLL sideloading kit.
SHA256	`fbdcf1c1ef19a5bef2c9ca43b3685aa5dacd78b7b071a90ced67ead83b736fa7`	SHA-256 of the malicious MSI installer posing as a Marvell RAID utility.