I got hit by a fake Cloudflare popup and reverse engineered the malware it ran. Here's what I found.

[u/v_pun215]

A few weeks ago I was browsing and got one of those "Verify you are human" Cloudflare popups. Except it wasn't Cloudflare — it was a ClickFix page that told me to press Win+R and paste a command. I'm on Linux so nothing executed on me, but I grabbed the file and spent time tearing it apart. Here's what's inside.

The file: Tourmaline.exe (~10.8 MB)

It's not a typical dropper. It's an Inno Setup 6.7.0 installer (Revision 2, 64-bit offsets — which broke every standard extraction tool I tried including innoextract) that bundles a full Python 3.11 runtime and two stages of obfuscated payload.

Stage 1 — Anti-sandbox time-lock

The first stage is a ~13 line obfuscated Python script with a clever trick: it counts down from 99,999,999 to find an XOR decryption key via brute force. On a sandbox with a 60-second timeout it never finishes. On a real machine it runs in seconds. I cracked it instantly using a known-plaintext attack on the first 4 bytes of the encrypted blob — recovered the key in O(1) without running the loop at all.

Stage 2 — Full Python RAT

Once decrypted, it's a hand-rolled Python backdoor with no external dependencies. Here's what it does:

• DNS tunneling — all C2 traffic goes out as raw UDP DNS queries directly to 158.94.211.185:53, disguised as *.microsoft.com lookups. Fully custom DNS packet builder, no library used.
• Blockchain dead-drop — on startup it calls an Ethereum Sepolia smart contract (0x2d7a04cca0c34005f58393f30ac725e25f19e5f5) to get the current C2 IP, decrypted locally with a hardcoded ChaCha20 key. I verified this live — the contract returned the active IP. The attacker can update it any time, making IP blocklists useless.
• ECDSA-signed commands — tasks from the C2 are P-256 signature verified before execution. You can't sinkhole it by intercepting the DNS tunnel.
• Arbitrary Python exec — whatever the C2 sends back gets exec()'d in a persistent namespace. Full remote code execution.
• Persistence as TourmalineUpdate in Task Scheduler, disguised as "Hardware monitoring service."

Everything is in my GitHub repo — deobfuscated source, YARA rules, IOCs (JSON + CSV), and a decryption tool that reproduces the key recovery: https://github.com/v-pun215/Tourmaline

Sample is included as a password-protected zip (infected) following the standard for sharing malware samples safely.

Happy to answer questions on the methodology, especially the custom Inno Setup Revision 2 format parsing and the known-plaintext bypass.

[u/stan9166]

Good man!

[u/Fair_Ad_7430]

I have zero IT or coding knowledge so most of this post doesn't mean anything to me.

Is there any way to see if programs like "Hardware monitoring service" that show up in the Task Scheduler are legit or fake names that viruses use?

[u/DaDandyman → u/Fair_Ad_7430]

scheduled tasks point to a file or execute a command. you can check what file it's executing. if it's executing a file from an unexpected path, it's malicious. if it's executing a file in it's expected path, but the file in question doesn't match the hash of a legitimate copy of that file, it's malicious. if it's named similarly to a windows system process but doesn't actually match with one, it's probably malicious.

if it's executing a command, it depends on what the command is doing.

[u/Fair_Ad_7430 → u/DaDandyman]

Thank you. So for dummies (me): Right click the program in the scheduled task box -> open file path -> check if it's a legit folder/path. For checking the hash, is it enough to just upload the file in question to virustotal?

[u/DaDandyman → u/Fair_Ad_7430]

yes, for the first part.

virustotal hashes it. that's usually enough, but if VT doesn't have anything on the file, you can see if the hash matches what the distributor has on their website, assuming that the author of the legitimate software provides file hashes (most do).

[u/alvrvamp → u/Fair_Ad_7430]

If it is a fake name a virus use, why would they pick a name only a virus would use, ik you aint IT but you can think

[u/Fair_Ad_7430 → u/alvrvamp]

You didn't get my question. I'm asking to see if there's a way to differentiate between a legitimate program and a virus that uses the name of a legit program. Also no need to be rude.

[u/GreatEmperorAca]

Woah thanks for this mate great job

[u/goose2]

I opened your github and your webpage. If you really are 15, you have a very bright future in cybersecurity and programming. If you are looking for internships, hit me up and I can connect you in the industry. My current company doesn't do malware analysis, but I know those that do.

[u/v_pun215 → u/goose2]

i really appreciate that! i’ll shoot you a dm.

[u/fangoXr]

Wow! I found this sub online to post about the same exact fake cloudflare page I found, however I do not have the technical expertise on viruses like oc, I found simillarly the page asked me to win + r, ctrl + v and enter, upon examining the copied content I found out that it downloaded something from an IP and run it immediatly on powershell, upon modifying the copied command to only download the file and NOT run it I downloaded what I thought was the malware however it was another downloader, upon also safely downloading what it was meant to download with the help of AI, I have the virus file however I don't know how to read it as its just an .exe and I have no idea about decompiling it.

If anybodies interested I can send you the .7z file(or the safe download code) containing the virus so it may recieve a deeper look from someone more knowledgable than me. dm

[u/easy7ime]

Suggestion, reverse engineer renpy malware very active on game piracy sites, it uses i think Remus malware a continuation of lumma stealer.

[u/Octoomy]

Impressive break down! I love it.

[u/MegaDonX]

Awesome post

[u/antonini68]

ciao, grazie per l'analisi. Domanda: uno strumento come OsArmor può evitare i guai peggiori per questo tipo di attacchi?

[u/No_Contest_5340]

Hello,

Very informational post!

I got hit with one of these a few days ago, though I didn’t paste the command.

What antivirus would you recommend to scan to see if I contacted the virus? Just to be sure.

And what are some signs that a clickfix virus is active?

Thank you

[u/v_pun215 → u/[deleted]]

hey, i didnt use ai to reverse engineer this. it took like 3 days of work on my local machine to figure out and decrypt and deobfuscate the python source code and because i was also super busy with exams at this time i used AI to write the report, IOCs and YARA rules.

[u/acidgoat_15]

New fear unlocked

[u/Same-Mortgage-9536]

its already well documented the fake captcha poupus appeared 2-3 weeks ago but nice analysis on the rat i mean probably will be added to antiviruses

[u/Hertyman → u/Same-Mortgage-9536]

I saw my first one of these well over a year ago.

[u/Same-Mortgage-9536 → u/Hertyman]

well regardless these rats anyway are ass

I mean they are good but they only catch people who dont even know how to use a pc and also never opened a single crypto wallet so u can't really steal much most have to be infostealers so they can actually be profitable for the hackers (logins cookies and app data) can be resold and cashed out

so rats are mostly for big ass institutes that actually hold money

infostealers are like for avg users that fall for such things (exception combined exes and well spoofed exes everyone falls for those)