QuiloBook: When the threat walks in through a trusted vendor

Email is no longer the only delivery problem. We’ve observed threat actors using messaging platforms (e.g. Slack, Microsoft Teams, Discord, Telegram, Google Chat) as a malware delivery vector, moving away from traditional phishing emails toward attachments and links dropped directly into team communication channels.

This particular campaign is a supply chain attack. As part of our internal malware research and threat intelligence efforts, we identified a campaign that abused trusted vendor communications to deliver malicious payloads. A vendor’s communication account gets compromised, and the malware is distributed through the existing trusted channel between the vendor and their customers. No cold outreach. No suspicious sender. Just a file or a link from a contact people already communicate with.

The payload we’re documenting here is a signed Rust binary we’re calling QuiloBook - a multi-stage infostealer loader that masquerades as a PDF reader, profiles the host for high-value targets, and pulls an encrypted second-stage payload hidden inside a PNG. These IOCs aren’t in any public threat intel database. We’re publishing, so other organisations can block and detect before they get hit.

The payload arrives as a message attachment or a link to drive.overviewshare[.]com posted inside a messaging channel. The link is crafted to look like a screenshot error notification:

The f= parameter presents the filename as .png but what gets downloaded is a Windows PE executable as Screenshot-error-10-06-2026.com but only to browser-like requests.

A normal user sees screenshot in the name, doesn’t notice the .com extension, and will naturally double-click it.

The file comes from a known contact in a messaging channel that people trusted, claiming to check this image. That’s the point. By the time anyone questions it, it’s already executed.

The binary’s internal name is QuiloBook.com, claiming to be Quilo Book - PDF Reader by Ulvex Tech. It’s a 64-bit Windows PE (written in Rust) ~4.7 MB, signed with a certificate issued by SSL.com to GADSON SOFTWARE CC (Pretoria, South Africa). The campaign also abuses a second legitimate certificate: 1NCRIVEL SISTEMAS LTDA (Brazil, EV certificate), used to sign NopingGameBooster.exe. Two separate stolen/abused certs across the same campaign.

When you run it, a fully functional PDF reader opens. File menu, edit, zoom, bookmarks, open/save/print - the whole thing. This is deliberate. The victim sees a working application and thinks nothing of it.

Meanwhile, a background thread starts doing something else entirely.

What it does:

1. Enumerates all running processes and scores them against a built-in list of 293 program names - 66 security tools, each with a weighted suspicion score, plus 227 high-value apps. Each security product carries a weight (~60 to 360, highest for enterprise EDR) and the matched total feeds a randomised startup sleep that is clamped to ~600 seconds (about 10 minutes). Sandbox evasion and host profiling in one.

2. Derives a fixed C2 download URL via HMAC-SHA256 over an embedded config block (not stored in plaintext). Fetches a 12.3 MB PNG using a spoofed Chrome 125 User-Agent over WinHTTP.

3. Downloads the PNG. The PNG carries a 2.87 MB encrypted blob appended after the image's end marker. Decoding is two layers:

   

   All 67 entries decode and inflate to a fake Flutter app bundle: NopingGameBooster.exe, a trojanised flutter_windows.dll, Visual C++ runtimes, and many real Flutter plugin DLLs for camouflage.

4. Parses a 106-byte token from the PNG response to derive the fallback hop URL if needed.

5. The trojanised flutter_windows.dll (Proj_am2.dll) is not the real Flutter engine. It re-exports all engine function names so the app starts normally, then on the first Flutter call it locates the sibling asset file, carves out the embedded RAT (libclient.dll hidden at offset 311 in Amplitude.bmp), maps it, and loads it.

6. Writes the decrypted payload to %APPDATA%\BackupBridge\Staging\, executes via CreateProcessW, then self-deletes via cmd.exe /c ping 127.0.0.1 -n 3 > nul & del <self>.

The real Flutter engine and app resources are missing, so it cannot run as a real program; its only purpose is to load the RAT.

Full 4-stage kill chain:

NopingGameBooster.exe is Flutter-based; the DLLs bundled around it - a trojanised flutter_windows.dll, Visual C++ runtimes, and many real Flutter plugin DLLs are camouflaged. It then replicates to %APPDATA%\ShadowRender\, a secondary persistence path only visible in live telemetry.

Each stage registers its own persistence before spawning the next.

libclient.dll is never visible as a standalone process. It’s loaded in-process by creator-ws.exe via DLL sideloading, making it invisible to process-based EDR detections. Hash not recoverable from process telemetry alone - module-load events required.

The campaign uses a three-stage C2 architecture, each stage with distinct hosting and purpose:

Stage 1 uses Hostinger - cheap, disposable. Stage 2 uses Private Layer INC, a known bulletproof hosting provider in Switzerland - slow to respond to abuse takedowns, used for the persistent payload. Stage 3 was blocked by a network gateway in the observed instance.

Active C2 domain observed in live telemetry: hobbyback[.]top - resolving to the same IP as spalatrice[.]top (31.7.63[.]74). 322 A-record DNS queries at exactly 60-second intervals post-infection. The implant re-resolves the hostname each cycle rather than caching the IP. Both domains should be blocked.

All C2 domains were offline at the time of passive recon - consistent with infrastructure rotated after campaign waves.

Network traffic mimics Chrome browsing - Chrome 125 user-agent, WinHTTP/WinINet, everything over HTTPS :443. Without DPI or SSL inspection, the initial sessions are invisible in proxy logs.

PNG download chain:

Both serve byte-identical PNG (SHA256: eba981...3671) - hop 2 is a fallback.

libclient.dll is a Rust DLL - the actual remote access component. Its strings are obfuscated with a per-string rotate-then-subtract cipher decoded at runtime. It installs COM, Run key, and Scheduled Task persistence simultaneously, then connects to C2.

Before the AES-256-GCM channel is established, the implant sends an INF registration packet containing:

• Antivirus products via WMI (ROOT\SecurityCenter2) and registry - checks 18 products including Avast, Kaspersky, Bitdefender, ESET, Sophos, Malwarebytes

• Full installed software list from registry uninstall keys

• OS build string, username/computername, foreground window title, privilege/integrity level

Process migration: The implant can hand off its live C2 socket to a child process via WSADuplicateSocketW / WSASocketW. The C2 session persists in the child even if the parent process is killed. Isolating via process termination alone is insufficient.

The 66-security-tool watchlist is the most operationally interesting part of the loader. The heavier the EDR, the longer the malware sleeps before C2 contact - designed to outlast sandbox analysis windows (60-300 seconds). On a real Falcon-enrolled host, this produced a confirmed longer delay.

The 227-app watchlist covers: Exodus, Ledger Live, Trezor Suite, Phantom, Electrum, Rabby, Atomic Wallet (crypto wallets), 1Password, LastPass, Bitwarden, KeePass (password managers), MetaTrader 5, NinjaTrader (trading terminals), Slack, Discord, Telegram (messaging), and VPN/hardware utilities.

This is victim profiling for financial targeting. The presence of trading terminals and crypto wallets alongside corporate messaging tools points to a clear objective: trading credentials, crypto wallet access, and corporate communication content.

This campaign is not a typical ClickFix lure. The threat actor looks to compromise vendors and use their existing trusted relationships to distribute the payload to the vendor’s customers via an already-trusted communications channel. This is a supply chain attack in the true sense - a compromised intermediary reaching targets who would never have interacted with the actor directly.

This TTP has not been publicly attributed to anyone in any report we found. It represents a step up in operational sophistication and target reach of the threat actors behind it.

The campaign tag a8f3c2e1 is the strongest attribution pivot. If this tag appears in any other sample in a vendor’s corpus - CrowdStrike Intelligence, Recorded Future, VirusTotal Enterprise - it would directly link campaigns and confirm whether this is an isolated operation or part of a broader wave. We recommend submitting the full IOC set with this tag to your threat intel partners.

All IOCs remain uncatalogued. Zero hits across every domain, IP, hash, and certificate name against public threat intel at the time of publication.

Publishing these details allows defenders to decrypt captured C2 traffic from other victims and build more precise detection rules.

All indicators are TLP:CLEAR. Please add these to your blocklists and submit to your threat intel platforms.

• Non-browser process loading winhttp.dll / wininet.dll with spoofed Chrome 125 UA, downloading a .com, then writing and executing under %APPDATA%\BackupBridge\Staging\

• Process list enumeration (CreateToolhelp32Snapshot) followed by long variable sleep before any network activity

• ~60-second DNS query interval to C2 domain - implant re-resolves hostname each cycle rather than caching IP

• Plaintext C2 idle heartbeat (network signature, pre-encryption): 2020352d65794a74633263694f69496966513d3d0a0a0a

• A Rust DLL whose DllRegisterServer self-registers a COM CLSID and then opens an outbound TCP connection to port 26115.

• Files signed by GADSON SOFTWARE CC or 1NCRIVEL SISTEMAS LTDA

• Scheduled tasks named Soda, XenoForgeFetch438f, or NetBalancerRuleSync

• A frequently re-launched process (creator-ws.exe) that loads a DLL and opens outbound TCP to 31.7.63[.]74, with periodic DNS lookups (~60 s) for a .top domain (spalatrice[.]top / hobbyback[.]top) resolving to that IP (observed during controlled live execution).

• Block all the domains and IPs above at the DNS, proxy, and perimeter firewall

• Block executable file types (.com, .exe, .pkg, .dmg) downloaded from uncategorized domains at the proxy

• TCP to 31.7.63[.]74 on ports 26115 and 19852 - C2 ports

• Isolate immediately - do not attempt live cleanup

• Assume stage-2 payload ran; treat the host as compromised

• Rotate credentials and review crypto wallets, password managers, and trading applications on affected hosts.

• Reimage/wipe the machine.

If you’ve seen this campaign or these IOCs in your environment, reach out to our Security team at security@deriv.com. We’re happy to share additional technical details under TLP:AMBER with other financial services organisations or threat intel teams.

If you work at a threat intel vendor and want to enrich these with additional context, we’d appreciate being looped in on what you find.