Signed SilentSetup Installer Delays Execution Before Deploying PackClient RAT

Oct 20, 2026 · Original article ↗

Summary

Analysis traces a signed Windows installer that waits until a hard-coded date, then uses DLL sideloading to deploy PackClient RAT. Its plugin adds persistence and a signed antivirus-killing driver, which failed to load in three sandbox runs.

Key points

SilentSetup exits until 11 October 2026 at 20:00 local time, then downloads and unpacks an archive into a hidden, randomly named folder under C:\.
The archive includes a renamed printer program that loads a malicious DLL; the DLL decrypts and runs the PackClient launcher in memory.
PackClient RAT can capture screens, log keystrokes and clipboard contents, control the device, run commands, transfer files, and hijack copied text.
The server pushed a plugin that establishes persistence and installs a signed kernel driver designed to terminate security products and protect the malware’s files and processes.
The driver failed to load in all three sandbox runs of this sample. A sibling dropper’s artifacts suggest it loaded in a separate VirusTotal sandbox, but the article does not establish that it works on all systems.
The investigation links the sample to the PackClient family but cannot identify who operated this campaign; named optional plugins were not observed in the analyzed sessions.
Defenders are advised to look for MicroEvent2026 tasks, the YgProtect service, and PackMonitorClient files and registry entries.

Article Details

Attack Vectors: SilentSetup.exe checks for a hard-coded date and time before continuing, then downloads china4.zip and unpacks it into a hidden, system-marked folder under C:\.
The dropped EventLog.exe, a renamed NimoPrinter program, loads a malicious cximagecrtu.dll placed beside it through DLL sideloading.
The malicious DLL decrypts update.xml and loads PackClientLauncher directly into memory; the launcher downloads and loads PackClientCore.dll from its control server.
PackClient RAT can capture screens, log keystrokes and clipboard contents, control the victim's system, transfer files, run commands, and route attacker traffic through the victim's PC.
The server pushed PackExtraPlugin.Ksl888.dll, which attempts persistence through scheduled tasks or a Run key and uses the YGProtect driver to disable security products and protect the trojan's files and processes.
In the three sandbox runs described, the driver failed to load; the article reports that a sibling dropper's driver may have loaded in a VirusTotal sandbox.
Defensive Notes: Treat an unexpected hidden folder with a random six-letter name under C:\ containing EventLog.exe and update.xml as a compromise indicator.
Hunt for scheduled tasks named MicroEvent2026 or MicroEvent2026Maint, the YgProtect service, and ygp.dat in System32\drivers or Windows\Temp.
Look for %LOCALAPPDATA%\PackMonitorClient\, HKCU\Software\PackMonitorClient\, and HKCU\Software\PackClientConsole\.
Alert on hidden PowerShell launched with -File …\pack_proc_guard.ps1 -WatchPid.
Block the listed download and control-server indicators, and use Emerging Threats rules for PackClient RAT as an additional network detection.
Avoid routine use of administrator accounts and keep Secure Boot enabled; the article notes that the driver failed in the reported runs and that Secure Boot makes unsigned-by-Microsoft drivers harder to load.
Verify the destination address after copying cryptocurrency addresses, because the RAT can replace clipboard contents matching an operator-defined pattern.
Do not treat a valid code-signing signature as proof that an installer is safe.

Indicators of compromise

Type	Indicator	Context
IPV4	`156[.]251[.]16[.]214`	Control-server IP used by a sibling zip with the same DLL; the article reports port 8790.
IPV4	`161[.]248[.]14[.]20`	Control-server IP used by the sibling dropper NexifySetup.exe; the article reports port 8790.
IPV4	`91[.]204[.]224[.]87`	PackClient control-server IP; the article reports the server answering on port 8790.
SHA256	`0efc2c7224d1662602fe6494f8d1834178ee5906a2270f33d7b2990bee79c7c9`	SHA-256 of the YGProtect driver, identified as ygp.dat.
SHA256	`4b1b874c662418773f3166a621e01a3863e0df7f87e7a0a02dc8038f2cb0fc35`	SHA-256 of an older YGProtect driver build.
SHA256	`82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f`	SHA-256 of china4.zip, the archive downloaded by SilentSetup.exe.
SHA256	`8bad5b867e640ef2a5d9909cde11788f78c45c9c40bea6c901cc0b9cf65bf91f`	SHA-256 of PackClientCore.dll, the PackClient RAT core downloaded from the control server.
SHA256	`93dfab86959d88de5c01186bfa92f52f91f8242045d274ef632f660bd7e41d51`	SHA-256 of PackClientLauncher, the malware launcher recovered from the sample.
SHA256	`af5062786294b67d1befa07b6a43e4f22cec72a887fe2e94e937688e15c53cc3`	SHA-256 of cximagecrtu.dll, the malicious sideloaded loader.
SHA256	`cba381dcd6b1ed6ddb494d35dc4f6be7dca832f040ef81cc4225e292c70e3dc1`	SHA-256 of update.xml, the encrypted payload file containing the program loaded by the malicious DLL.
SHA256	`dc27bb3c16f98f11a2cdb88be7c4d3edf8348ce5b1a9334f5bd2e569f3cbf050`	SHA-256 of SilentSetup.exe, the signed installer in the reported malware chain.
SHA256	`e7f671e57206d2ce764bae5a8e9424224c4e0992bdc0093cece5f5ca49bcffd0`	SHA-256 of NexifySetup.exe, a sibling dropper signed with the same installer certificate and reported to drop the same driver and helper DLLs.
SHA256	`ff66f97a671ca22a6ba00027b1ed7320322a03ba9652d314edfaa707bfa02b14`	SHA-256 of PackExtraPlugin.Ksl888.dll, the server-pushed plugin that attempts persistence and driver-based security-product interference.
URL	`hxxp[:]//108[.]187[.]43[.]139:8080/china4[.]zip`	Payload-download URL used by SilentSetup.exe to retrieve china4.zip.