Lab Reconstructs QUICSILVER Backdoor Delivered Through a VHD

Aug 25, 2026 · Original article ↗

Summary

Researchers reconstructed a QUICSILVER backdoor from VHD-contained fragments and confirmed its hash matched a published sample. Isolated testing observed Startup-folder persistence, but no successful C2 session or campaign attribution was independently established.

Key points

A VHD contained a disguised shortcut, decoy PDF, FTP command script, and two payload fragments; joining the fragments reproduced the published Windowsupdate.exe hash.
In an isolated direct execution, the payload created a SystemIn shortcut in the user's Startup folder.
A separate debugger-conditioned trace recorded hidden PowerShell activity and repeated DNS resolution attempts for two Worker hosts; all 46 captured GetAddrInfoW results indicated host-not-found.
The lab did not reproduce successful C2 communication, QUIC traffic, attacker tasking, file transfer, or the original VHD-mount delivery step.
The article attributes campaign history, infrastructure, and China-nexus assessment to Seqrite; its own analysis does not independently identify a threat group.
The MalwareINFO scan reported suspicious findings, but unavailable hash databases and degraded memory protection limited coverage; the result was not treated as a confirmed verdict.

Article Details

Attack Vectors: Seqrite reports diplomatic and regional-cooperation themed lures delivered in VHD files containing a disguised PDF-looking LNK, a decoy PDF, an FTP command script, and two payload fragments. The script concatenates the fragments into Windowsupdate.exe and starts it; the original delivery-to-VHD-mount step was not reproduced.
In a direct lab execution of the reconstructed payload, Windowsupdate.exe created a SystemIn shortcut in the current user's Startup folder. A separate debugger-conditioned trace recorded hidden PowerShell creating a Startup shortcut after analyst intervention.
Defensive Notes: Inspect files by content rather than extension, and review scripted ftp.exe use together with its script path and parent container.
Correlate document-named fragment files, copy /b reconstruction, the resulting executable hash, and source VHD.
Monitor per-user Startup shortcut creation and verify the shortcut target's file identity.
Review hidden PowerShell execution, transient create_lnk_*.ps1 files, and their writer, child process, and deletion sequence while preserving process and session boundaries.
Hunt for both Worker hostnames and repeating resolver attempts; the lab observed failed resolution and no successful C2 session.
Correlate outbound UDP/443 or Worker-host resolution with the delivery chain, payload identity, and persistence behavior; broad QUIC blocking may cause false positives.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`maui-cocktailbar[.]com`	Domain assigned by the article to the separate HolidayNotice.pdf.exe branch.
DOMAIN	`register[.]mediumser[.]com`	Domain Seqrite reportedly observed being returned dynamically by a Worker; it was not found as a hardcoded payload string.
IPV4	`104[.]64[.]211[.]22`	Historical/runtime infrastructure reported by the article in connection with the campaign.
IPV4	`38[.]60[.]244[.]141`	Historical/runtime infrastructure reported by the article in connection with the campaign.
SHA256	`0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39`	SHA-256 of ACMECS_Pillar_1.vhd, an article-identified delivery container.
SHA256	`26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916`	SHA-256 of TrainingAnnouncement.jpg, which the article identifies as a VHD delivery artifact.
SHA256	`446c09e3ced078f3f70460bac61b665ba60863d9e39c67bcf066ff962f328f17`	SHA-256 of the preserved original archive containing the analyzed sample corpus.
SHA256	`4a1a1b1455c3ea91a3d9203ebff025553227302cede6077e821d303655e2c9f2`	SHA-256 of header.doc, a payload fragment used to reconstruct Windowsupdate.exe.
SHA256	`575305cdaeb1d2187ca6d5ebe32f4c3e3fb53f5ccbe1c0cc257a7f71d84e6f35`	SHA-256 of the TrainingAnnouncement.pdf decoy contained in the delivery chain.
SHA256	`aeff39943e254c34187e4a60be3d09d49687439e709eeb4be2b1984310d8ba5c`	SHA-256 of body.doc, a payload fragment used to reconstruct Windowsupdate.exe.
SHA256	`c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02`	SHA-256 of the related HolidayNotice.pdf.exe sample, treated in the article as a distinct branch.
SHA256	`cd147efe37003399e174951927e5fe727a4481756b116f0204a14a64cc62b059`	SHA-256 of the reconstructed Windowsupdate.exe payload; it exactly matched the payload indicator published by Seqrite.
SHA256	`daeac66441b88ba22806f6617058a2dbf1ea0ddcc6c94f291542ea853ac6f9d3`	SHA-256 of the TrainingAnnouncement.pdf.lnk delivery shortcut.