Based on the provided information, here's a summary of the malware analysis and attack lifecycle:
Malware Analysis
ms_upd.exe (Downloader)
- Functionality: Acts as a downloader to retrieve additional payloads from a C2 server.
- Behavior:
- Collects host information (computer name, username, domain).
- Registers with the C2 server at
moonzonet[.]com. - Receives instructions and downloads three components:
- Game.dll (saved as WebView2Loader.dll)
- Game.exe
- Game.config (saved as visualwincomp.txt)
- Communication:
- Sends periodic
/checkrequests to the C2 server. - Reports status updates ("downloading", "running").
- Sends periodic
- Obfuscation: None; uses plaintext strings and statically resolved API imports.
Game.exe (Custom RAT)
- Functionality: A custom Remote Access Trojan that masquerades as a legitimate Microsoft WebView2 application.
- Behavior:
- Trojans the official Microsoft WebView2APISample project.
- Implements obfuscation and anti-analysis techniques.
- Obfuscation Techniques:
- Dynamic API calls (T10
Read the full article at Rapid7 Blog
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



