An email-based attack campaign distributes a ZIP archive via MediaFire containing a Python setup executable (Setu.exe). This executable side-loads a malicious 400 MB python37.dll with repeated byte padding. The DLL injects code into the legitimate dllhost.exe process and establishes communication with a C2 server at IP 138.124.186.2 on port 7000. The threat actor employs three persistence mechanisms: a PowerShell-based persistence path, a scheduled task running a fake EdgeUpdate Python executable, and NetSupport RMM as a third access method. The campaign uses techniques including DLL side-loading, process injection, scheduled task persistence, and remote access tools. The investigation highlights the utility of comparing file timestamps during triage to identify malicious artifacts hidden in compressed files.

The threat enables remote code execution and persistent access on compromised systems through multiple persistence mechanisms and process injection. The use of a large malicious DLL and process injection into a trusted Windows process (dllhost.exe) can evade detection. The deployment of NetSupport RMM provides the attacker with remote management capabilities. The infection chain initiated via email and MediaFire-hosted ZIP files increases the risk of user-initiated compromise. No known exploits in the wild are reported, but the attack can lead to unauthorized remote access and control.

No official patch or fix is available for this threat as it is a malware campaign rather than a software vulnerability. Mitigation should focus on user awareness to avoid opening suspicious email attachments or downloading files from untrusted sources such as unsolicited MediaFire links. Security teams should analyze file timestamps during triage to detect malicious files within archives. Monitoring for the identified indicators of compromise (e.g., IP 138.124.186.2, domains bsc.blockrazor.xyz and xn--fiqq24b9hejs1c.clickvector.tech) and blocking them at network boundaries can reduce risk. Detection and removal of persistence mechanisms such as scheduled tasks and NetSupport RMM installations are recommended.