Malicious Telegram Download Site Pushes Multi-Stage Loader With In-Memory Execution
A deceptive website impersonating Telegram is distributing malware to users by masquerading as a legitimate installation file. The domain, telegrgam[.]com, closely resembles the official Telegram URL and offers a Windows installer, tsetup-x64.6.exe , to…
A deceptive website impersonating Telegram is distributing malware to users by masquerading as a legitimate installation file. The domain, telegrgam[.]com, closely resembles the official Telegram URL and offers a Windows installer, tsetup-x64.6.exe , to visitors.
The malicious installer uses a multi-stage loader to execute the payload in system memory, avoiding traditional file-based detection methods. This complex malware modifies Windows Defender settings, deploys staged components, and executes code directly in memory.
Traditional security tools struggle to detect such in-memory threats as they rely on stored file scanning. K7 Security Labs discovered this campaign during routine monitoring, highlighting typosquatted domains used for fake application distribution.
The malware, once executed, connects to a command-and-control server at 27[.]50[.]59[.]77:18852 associated with the domain jiijua[.]com. This connection allows attackers to issue commands, update payloads, and continuously monitor infected systems.
When run, the fake installer checks for a process named 0tray.exe to determine if the system is already compromised. It executes an obfuscated PowerShell command to exclude all drive partitions from scanning, disabling real-time protection.
Files are discreetly placed in C:\Users\ \AppData\Roaming\Embarcadero\ to mimic legitimate software and evade detection. A registry entry is created to prevent reinstallation on infected systems. A legitimate Telegram executable is deployed to maintain the façade of a genuine installation.
The core attack mechanism leverages AutoRecoverDat.dll , executed via rundll32.exe . This DLL reads encoded data from GPUCache.xml , constructs a portable executable in memory, and runs it using reflective loading techniques, making the payload blend seamlessly with normal processes.
A deceptive website impersonating Telegram is distributing malware to users by masquerading as a legitimate installation file.
Type Value Detection
MD5 (tsetup-x64.6.exe) A9A5CC6B6766FEC51B281B94F5F17CCD Trojan(005cea261)
MD5 (Loaded Payload) 62F8EFFC7690455ABCB300E3574F0A93 Trojan(005d198a1)
C2 IP 27[.]50[.]59[.]77:18852 —
C2 Domain jiijua[.]com —
Fake Domain 1 www.telegrgam[.]com —
Fake Domain 2 www.telefgram[.]com —
Fake Domain 3 www.tejlegram[.]com —
Users are advised to download software only from official and verified sources, ensuring the URL is correct before downloading any file. Keeping security tools updated and monitoring network traffic for unusual outbound connections are essential measures to detect potential threats.
Based on reporting by Cyber Security News.