Zscaler Analyzes MLTBackdoor, a ClickFix-Delivered Backdoor With a BOF Loader
Summary
ThreatLabz details MLTBackdoor, a backdoor delivered through a ClickFix infection chain and likely linked to ransomware activity. It supports file operations and Beacon Object Files, and uses heavy obfuscation, anti-analysis checks, encrypted communications, and a DGA.
Key points
- ThreatLabz identified MLTBackdoor in May 2026 and assesses it is likely used by a ransomware-related threat actor for foothold and lateral-movement activity.
- The observed infection chain starts with a ClickFix lure on an automotive-related webpage and delivers the backdoor through a multi-stage process.
- The malware uses mixed Boolean-arithmetic and control-flow-flattening obfuscation, runtime API hashing, and indirect system calls to complicate analysis and detection.
- Ten anti-analysis checks are aggregated into a bitmask and reported to the command-and-control server; they do not stop execution.
- Built-in commands support file downloads and uploads, directory listing, deletion, renaming, and folder creation.
- A Beacon Object File loader enables additional post-exploitation capabilities, including calls through the malware’s indirect system-call wrappers.
- Communications use a custom encrypted protocol over TLS, with a date-based domain generation algorithm providing alternate domains if C2 servers are unreachable.
Article Details
- Attack Vectors
- A ClickFix lure on an automotive-related web page prompts victims to copy, paste, and execute commands that download and run a compressed archive.
- The downloaded archive contains endpointdlp.dll and encrypted data.bin; the DLL decrypts the payload, which performs a self-update and is sideloaded through the legitimate signed mpextms.exe executable.
- MLTBackdoor supports file download and upload, directory listing and modification commands, and loading Beacon Object Files (BOFs) for post-exploitation tasks.
- Defensive Notes
- Monitor for the described ClickFix execution chain, including curl retrieval, archive extraction, rundll32 execution of endpointdlp.dll, and sideloading through mpextms.exe.
- Use behavioral detection for MLTBackdoor’s indirect system calls, runtime API hashing, BOF loading, encrypted TLS communications, and date-based domain generation.
- The malware checks for analysis environments but does not halt execution when checks are detected; it reports aggregated check results in its initial request.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | carrolc[.]com | MLTBackdoor C2 domain. |
| DOMAIN | cwrtwright[.]com | MLTBackdoor C2 domain. |
| DOMAIN | rs2y15sungu[.]com | MLTBackdoor DGA domain used for C2 communication and the distribution campaign. |
| DOMAIN | thomphon[.]com | MLTBackdoor C2 domain. |
| SHA256 | 1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf | Hash of an MLTBackdoor sample using the DGA only. |
| SHA256 | 1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984 | Hash of the stage one loader. |
| SHA256 | 2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494 | Hash of an MLTBackdoor sample containing domains only. |
| SHA256 | 46b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e93 | Hash of the archive containing the stage one loader and encrypted MLTBackdoor. |
| SHA256 | 9e52cc90cff150abe21f0a6440e86e0a99ff383b81061b96def8948e21d0ac66 | Hash of an MLTBackdoor sample containing domains and DGA. |
| SHA256 | ced6b0f44410f6133ad63b61e04613a8b56cc3338d7b34497540e9541163e7ec | Hash of an MLTBackdoor sample using the DGA only. |
| SHA256 | d34e4038c5c80728f9648ba84833f69bc1ccea82e2e8e748b7b7f02fb687b92b | Hash of the MLTBackdoor update sideload archive. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationMLTBackdoor uses MBA and control flow flattening to obfuscate its code.T1041 · Exfiltration Over C2 ChannelMLTBackdoor’s built-in commands include uploading files from the victim’s system.T1059.003 · Windows Command ShellThe ClickFix chain executes commands through cmd.exe.T1071.001 · Web ProtocolsMLTBackdoor communicates with its C2 over TLS using a fixed HTTP path and User-Agent.T1105 · Ingress Tool TransferMLTBackdoor’s built-in commands include downloading files from the victim’s system.T1140 · Deobfuscate/Decode Files or Informationendpointdlp.dll decrypts the RC4-encrypted data.bin payload.T1189 · Drive-by CompromiseThe infection chain starts with a ClickFix lure on an automotive-related web page.T1497.001 · System ChecksMLTBackdoor checks for virtualization and sandbox indicators, including hypervisor details, drivers, RAM, CPU count, and uptime.T1497.003 · Time Based ChecksMLTBackdoor performs a timing check using repeated RDTSC and CPUID loops.T1568.002 · Domain Generation AlgorithmsMLTBackdoor uses a date-based domain generation algorithm to maintain C2 contact.T1573.001 · Symmetric CryptographyMLTBackdoor encrypts C2 communications using ECDH-derived AES-256-GCM session keys.T1574.002 · DLL Side-LoadingThe decrypted MLTBackdoor payload reuses the endpointdlp.dll filename and is sideloaded through the legitimate signed mpextms.exe executable.T1622 · Debugger EvasionMLTBackdoor checks for debuggers and other analysis environments.
Malware
Vendors
Products
Tools
Cobalt Strikewithin its own process, then free. Using BOFs for post-exploitation tasks was first popularized by Cobalt Strike, and there are now hundreds of community-made BOFs for a wide range of tasks.FLOSSmachine, the only reliable way to recover it is to trace the state transitions, defeating tools like FLOSS that look for consecutive characters in memory.