Bulletins

Static analysis of a ClickFix collection reveals WallStealer payloads, Steam-based C2 discovery and an XMRig mining chain sharing the delivery IP.

September 12, 2026 ·6 min read

Overview

An open directory at 94[.]103[.]1[.]175:16482, identified through Hunt.io during our July 2026 investigation, contained a fake Cloudflare verification script and several protected executables. The initial research followed the trail to WallStealer and Steam community profiles used to locate its command-and-control infrastructure.

Hunt.io open-directory

Additional payloads found in the directory were linked to XMR mining.

The Verification Trap

captcha.js presents a fake Cloudflare checkbox. Clicking it attempts to copy an obfuscated PowerShell command to the clipboard. About 5.4 seconds later, the page instructs the user to open Windows Run, paste and press Enter.

Decoding the command’s character list reveals its destination:

hXXp://94[.]103[.]1[.]175:16482/runtime_567c7f79.exe

The command is designed to download the executable into %TEMP%\u.exe and launch it. captcha.min2.js contains the same command. The requested runtime_567c7f79.exe was not included in our collection, so we cannot establish which payload it delivered.

Two other scripts contain mistakes. west3.js points to hXXps://txuploading[.]xyz/keywp.exe, but uses inconsistent variables for downloading and execution. The Google/reCAPTCHA-themed captchaloader.min.js constructs its intended URL incorrectly because of PowerShell operator precedence.

Unwrapping the Payloads

key_x38512.exe, keywp.exe and stube.exe share a Rust dropper framework. We recovered their AES-256-GCM keys and verified the authentication tags before inspecting the decrypted files.

The .dat files are Windows executables. The wrappers write them to disk and launch a child process.

The two stealer payloads differ in just ten bytes within a build-identifier field. Recovered strings expose browser-password and cookie collection, autofill and payment-card queries, screenshots, host profiling, and targeting of Telegram, Discord, Steam, FileZilla and wallet data. Configuration and upload paths include /api/config and /api/upload.

KYUYW.exe uses a different loader. We authenticated two encryption layers around its resource-based payload, but the subsequent decoded buffer did not form the executable its loading code expects. Its final malware family remains unconfirmed.

Steam as a C2 Address Book

The WallStealer binaries contain code for retrieving Steam profile pages and extracting the actual_persona_name field. This makes Steam a dead-drop resolver: the profile name supplies the destination for subsequent malware communication.

Both recovered stealers contain these profile IDs:

76561198697210556
76561198697403215
76561199690710773

The original investigation recorded dasdamatar[.]icu on the first profile, with previous names noveuam[.]top and dataramara[.]icu. The screenshot below preserves that historical observation.

Steam profile names captured

Historical VirusTotal screenshots also connect other samples to Steam profiles, including 76561199690710773, now independently recovered from our local binaries.

Related sample's contacted URLs

A Miner in the Same Collection

Further unpacking of stube.exe recovered an XMRig 6.25.0-derived DLL and WinRing0 1.2.0.5 driver. The miner contains 94[.]103[.]1[.]175:3333 callback, a wallet/user value, and the arguments --background and --donate-level=0.

The mining loader references C:\ProgramData\NVDisplay as a deployment directory for its components. Defenders can check files created there against the recovered hashes and investigate the processes that wrote them. The path was identified through static analysis; we did not observe files being installed there on a victim system.

IOCs

MITRE ATT&CK

These mappings describe implementation evidence; no sample was executed in the follow-up analysis.

Conclusion

The collection supports both credential theft and mining. For defenders, the strongest signals are the sequence of a pasted PowerShell command, temporary executable creation, unusual Steam-profile requests, and persistence artefacts associated with mining.