u/rifteyy_

A malicious LNK disguised as a PDF launches a multi-stage chain with cmd.exe, LOLBins, AutoIt, and PowerShell, leading to stealer deployment and persistence. The risk is post-click compromise.

Observed behavior: hidden command execution with disabled output, curl.exe downloads, PowerShell ExecutionPolicy Bypass, mutex creation, and persistence setup.

cmd.exe /V:ON enables delayed environment variable expansion, while /D disables execution of AutoRun commands. Fewer artifacts make the chain harder to trace and can delay containment.

See the execution chain and collect IOCs to speed up detection & response: https://app.any.run/tasks/81e896a9-849b-491f-8dc4-edd51fed632b/

Full report is available at https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

The exposed server at 198[.]245[.]53[.]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed testewin.com subdomain.

IoC:

• 198[.]245[.]53[.]26
• https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413

Remus Stealer is a rapidly evolving Malware-as-a-Service infostealer that emerged in 2026.

Remus also shifted from Lumma's 32-bit architecture and traditional resolvers to 64-bit with EtherHiding and enhanced anti-analysis (e.g., sandbox DLL checks, PST honeypot detection).

• It utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns.
• The malware steals credentials, browser cookies, authentication tokens, and cryptocurrency wallet data.
• Session theft is one of Remus's most dangerous capabilities because it can bypass MFA by stealing active session cookies directly from browser memory.
• The malware shows strong technical similarities to Lumma Stealer and may represent its evolutionary successor.
• Financial services, healthcare, government, technology firms, and MSPs are particularly attractive targets.
• Common infection vectors include phishing, fake software downloads, malvertising, and fake CAPTCHA campaigns, as well as SEO poisoning and fake GitHub projects to trick tech-savvy users.

See whole ANY.RUN execution chain at https://app.any.run/tasks/ae43628b-9d56-4c43-abac-fae7266c749f/

Check out whole malware analysis report at https://any.run/malware-trends/remus/

Harvard and ~140 other compromised legitimate sites are now spreading ClickFix malware.

hxxps://hir.harvard.edu/israel-and-international-football-a-breaking-point/
hxxps://hir.harvard.edu/a-better-way-forward-an-interview-with-paul-ryan/

Both contain a remote load script in it's HTML that reverses it's C2 sj.ssc/ipa/orp.eralfduolccitats to original form and then displays the ClickFix box from it.

C2: hxxps://staticcloudflare.pro

AnyRun identifies the loading pattern well:

• https://app.any.run/tasks/2ac73567-8bdf-41b0-999e-08057deb3dd3
• https://app.any.run/tasks/8362c5f5-11ab-4b34-b7a5-8e2fb2d6355c

Sandbox detonation of one of the ClickFix payloads:

• https://app.any.run/tasks/bf4b5c8d-f76d-4398-b465-9a1d8ec899bb

Original post and more discovered compromised URL's: https://x.com/rifteyy/status/2057842147630411877

According to https://www.reddit.com/r/jdownloader/comments/1t6goqe/is_the_website_hacked/, the JDownloader site delivered malware on 20:12 - 07.05.2026 GMT+2.

u/Takia_Gecko did a very well technical analysis in this comment so I would like to focus on the proper steps to remediate this infection.

Execution chain:

To clarify, the installer was replaced with a malicious signature-less version that delivered the official JDownloader and exactly 8 minutes after the initial setup start, it decrypted and executed the malicious payload that consisted of installing the Python interpreter, PyArmor runtime for code obfuscation and then starting a Python remote access malware.

When the malware is executed, Windows Defender is fully disabled, Windows Updates are also disabled and a root certificate is installed

I have also discovered several strings that may indicate manipulating with:

• Manual malware removal software such as FRST
• Antivirus scanners such as HitmanPro, Kaspersky Virus Removal Tool
• Antivirus software such as Avira, Avast, Windows Defender

Remote access malware (RAT):

• You can remove the visible signs of this infection, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. A backdoor or RAT gives the attacker complete access to your system, allowing them to steal data, install additional malware, or monitor your activity.
• This means that at some point the attacker was able to interact with your PC (see your desktop, view files, open programs) just like you are able to do so. For this reason, we do not recommend manual malware removal, because the malware could be embedded deeper in the system or able to manipulate with the removal process and making it ineffective.
• If your computer was used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for banking, email, eBay, PayPal, online forums, etc). Consider these accounts already compromised.
• I suggest you read and follow this guide on how to properly change your passwords after a stealer infection: https://rifteyy.org/report/the-ultimate-guide-to-infostealers - specifically the section "How to properly secure my accounts"

Proper steps to take now:

If you have executed the file, you can not guarantee a 100% clean system because of the malware's natures and because of how many changes it had already done on execution (disabling antivirus, manipulating with antivirus scanners, disabling Windows Updates, installing a root certificate) so please follow one of these steps to ensure your device is clean from the malware:

• Recommended: Windows 11 reinstalling via USB
• Windows 11 Cloud reinstall without keeping files

JDownloader is compromised!

• The replaced malicious executable contains the official and benign JDownloader in resources along with an XOR encrypted blob also available in resources
• The encrypted blob after 8 minutes of waiting to prevent sandbox noise is decrypted and executed, the next stage contains also several XOR encrypted resources and the official Python installer
• After decrypting resources, they contain PyArmor encrypted file and PyArmor runtime
• Delivers sophisticated Python remote access malware

See AnyRun execution chain along with the 8 minute wait before the payload starts: https://app.any.run/tasks/e0cecc2d-5571-49fe-a549-cc7d1b8b5908

IOC's:

• Initial delivered installer -> 5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3
• Stage 2 payload -> 77a60b5c443f011dc67ace877f5b2ad7773501f3d82481db7f4a5238cf895f80
• PyArmor encrypted blob: 5fdbee7aa7ba6a5026855a35a9fe075967341017d3cb932e736a12dd00ed590a
• hxxps://parkspringshotel[.]com/m/Lu6aeloo.php (most likely another compromised URL)
• hxxpx://auraguest[.]lk/m/douV2quu.php (most likely another compromised URL)

Known compromised versions are starting from 12.5.0.2421 to 12.5.0.2434.

I was able to obtain download infected version 12.5.0.2433 at this moment from their site -> app.any.run/tasks/21e9e07e-4043-4312-9b81-6c066c0485d3

See https://securelist.com/tr/daemon-tools-backdoor/119654/ for full write-up.

https://www.virustotal.com/gui/file/e22024a58de56b3655d6be7e3b21703325a57e0dd920bd9611588f5e33bb5132/relations

Known compromised versions are starting from 12.5.0.2421 to 12.5.0.2434.

I was able to obtain download infected version 12.5.0.2433 at this moment from their site -> app.any.run/tasks/21e9e07e-4043-4312-9b81-6c066c0485d3

See https://securelist.com/tr/daemon-tools-backdoor/119654/ for full write-up.

https://www.virustotal.com/gui/file/e22024a58de56b3655d6be7e3b21703325a57e0dd920bd9611588f5e33bb5132/relations