Technical Analysis of MLTBackdoor

Summary

Zscaler ThreatLabz identified a new malware family, MLTBackdoor, in May 2026. The threat is delivered through a multi-stage ClickFix infection chain and appears to be used by ransomware operators to establish initial access and support lateral movement. The malware relies on strong obfuscation, a domain-generation algorithm, and a Beacon Object File (BOF) loader to expand its capabilities after execution. Its network communications are encrypted over TLS and are designed to resemble legitimate Microsoft Delivery Optimization traffic, helping the activity blend into normal network behavior.

Investigation

The analysis followed the infection chain back to a conhost.exe wrapper that downloaded a compressed archive from a domain generated through the malware’s DGA logic. Inside that archive, endpointdlp.dll decrypted an RC4-encrypted payload that was then loaded as the MLTBackdoor binary. Researchers found that the malware uses mixed Boolean arithmetic, control-flow flattening, indirect system calls, and a custom encrypted communication protocol to hinder analysis and detection. The embedded BOF loader also allows the operators to run additional Cobalt Strike-style modules in memory.

Mitigation

Defenders should block the identified command-and-control domains and monitor for the related DGA patterns. Detection should also focus on the specific user-agent string and TLS traffic directed to /api/v1/telemetry over port 443. Security teams should watch for suspicious use of conhost.exe with the documented arguments and for creation of endpointdlp.dll in temporary directories. Behavior-based detections for API hashing and indirect system call usage can further improve visibility into MLTBackdoor activity.

Response

If MLTBackdoor activity is detected, isolate the affected endpoint immediately, terminate the malicious process, and remove any files dropped into the Temp directory by the initial loader. Investigators should then perform a forensic review for additional BOF modules or follow-on payloads. Any potentially exposed credentials should be reset, and threat hunting should be expanded to identify lateral movement attempts using the same tradecraft.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Recon – Resolve DGA domain – The backdoor generates a DNS query for hrs2y15sungu.com, a domain produced by its internal DGA.
  2. C2 Contact – Open a TCP socket – Using PowerShell, the adversary creates a raw TCP connection to the resolved IP on port 443 (HTTPS) to blend with normal traffic.
  3. Payload Retrieval (T1105) – Over the same socket the backdoor would pull additional modules; for the test we simply send a harmless string.

  These steps emit a Sysmon Event ID 3 record with DestinationHostname = hrs2y15sungu.com, satisfying the Sigma rule’s selection condition.

• Regression Test Script:

  # TC-20260610-A7B3Z – Simulate MLTBackdoor C2 communication
  # -------------------------------------------------------
  # 1. Resolve the malicious domain (simulated DGA output)
  $malDomain = "hrs2y15sungu.com"
  try {
      $ip = [System.Net.Dns]::GetHostAddresses($malDomain)[0].IPAddressToString
  } catch {
      Write-Error "Failed to resolve $malDomain – aborting test."
      exit 1
  }
  
  # 2. Open a TCP connection to the resolved IP on port 443
  $port = 443
  $client = New-Object System.Net.Sockets.TcpClient
  $client.Connect($ip, $port)
  
  # 3. Send a harmless payload (simulating module fetch)
  $stream = $client.GetStream()
  $payload = [System.Text.Encoding]::ASCII.GetBytes("TEST_PAYLOAD")
  $stream.Write($payload, 0, $payload.Length)
  
  # 4. Keep connection alive briefly to guarantee log generation
  Start-Sleep -Seconds 5
  
  # 5. Clean up
  $stream.Close()
  $client.Close()
  Write-Output "Simulation completed – connection to $malDomain ($ip:$port) closed."

• Cleanup Commands:

  # Ensure no lingering sockets remain (in case the script aborted)
  Get-NetTCPConnection -RemotePort 443 |
      Where-Object { $_.RemoteAddress -eq (Resolve-DnsName hrs2y15sungu.com).IPAddress } |
      ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }