Fake Telegram Download Site Delivers Stealthy In-Memory Malware Loader

A recent malware campaign targeting Telegram users has been identified, utilizing a typosquatted domain, telegrgam[.]com, to distribute a trojanized installer.

The fraudulent site closely resembles the legitimate Telegram download page, offering a malicious executable named tsetup-x64.6.exe . Upon execution, this installer initiates a multi-stage attack while simultaneously deploying a genuine Telegram installer to avoid detection.

During its operation, the installer executes several commands via cmd.exe , including process enumeration, potentially checking for security tools or previous infections.

One critical action is the alteration of Windows Defender settings through a PowerShell command that adds all system drives to Defender's exclusion list. This modification effectively disables antivirus scanning, allowing the malware to remain undetected.

Registry entries are also created, likely acting as infection markers, which help the malware identify compromised systems and prevent redundant reinfection.

The malware deposits multiple payload components in the directory: C:\Users<User>\AppData\Roaming\Embarcadero\ . This directory name helps the files blend with legitimate development tools. Additionally, a genuine Telegram installer is deployed at C:\Program Files (x86)\Applica\telegrom.exe , reducing user suspicion.

Instead of directly containing the payload, a DLL reads encoded data from an XML file named GPUCache.xml , reconstructing a Portable Executable (PE) payload at runtime. This payload is loaded directly into memory using reflective loading techniques.

A malicious DLL named AutoRecoverDat.dll is executed via rundll32.exe , with its entry point exposed as DllRegisterServer . This method involves memory allocation, PE mapping, resolving imports, and execution transfer within a legitimate Windows process, allowing the malware to blend into normal system activity and evade detection.

Once active, the malware establishes a TCP connection to its command-and-control infrastructure at 27[.]50[.]59[.]77:18852 , linked to the domain jiijua[.]com . This connection facilitates command execution, payload updates, and persistent access.

Network analysis indicates continuous communication with the C2 server, enabling remote command execution, data exfiltration, and system monitoring. The malware includes a flexible update mechanism, allowing it to download updated payload components directly from the C2 server and execute them in memory.

This campaign demonstrates the sophistication of loader-based malware, particularly the use of in-memory execution and legitimate system tools to evade detection.

MD5 Detection Name

A9A5CC6B6766FEC51B281B94F5F17CCD (tsetup-x64.6.exe) Trojan(005cea261)

62F8EFFC7690455ABCB300E3574F0A93 (Loaded Payload) Trojan(005d198a1)

Users are advised to download software only from official sources and verify domain authenticity before installation.

Based on reporting by GBHackers.