A detailed technical analysis of a five-stage .NET loader infection chain that begins with a malspam email abusing Google's DoubleClick for reputation evasion. The lure uses a personalized phishing kit that dynamically rebrands itself per victim using their email domain. Once executed, a JScript file kicks off a chain through PowerShell and .NET components that performs anti-analysis checks, disables Windows Defender and AMSI/ETW telemetry, establishes NVIDIA-themed persistence via registry Run keys and scheduled tasks, and ultimately injects a final payload into InstallUtil.exe or MSBuild.exe via RunPE process hollowing. The loader communicates over AES-encrypted, protobuf-serialized TCP with certificate pinning, collects hardware fingerprints including GPU details, and supports in-memory injection, PowerShell, and file-drop payload delivery modes. Full IoCs and detection recommendations are included.
