RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser Theft 

Key Takeaways

• Blackpoint’s Adversary Pursuit Group (APG) identified two previously undocumented .NET malware components delivered together through a ClickFix chain: RemotePanel, a persistent remote access platform, and BoundSiphon, a credential and cryptocurrency stealer. 

• RemotePanel establishes persistence by masquerading as the Windows Time service and gives operators broad control over infected systems, including PowerShell, file and process management, screen access, modular HVNC, and fleet management. 

• RemotePanel uses a BNB Smart Chain contract to resolve its active Command and Control (C2) server, allowing operators to rotate infrastructure without rebuilding or redeploying the RAT. 

• BoundSiphon runs primarily from memory and targets browser credentials and sessions, cryptocurrency wallets, password manager data, and selected documents, including secrets protected by Chromium App-Bound Encryption. 

• APG identified strong code and build overlap between BoundSiphon and a stealer previously documented by Socket, linking the sample to an earlier stealer codebase or builder lineage. 

• APG is seeking additional research and samples tied to RemotePanel, BoundSiphon, the AntiSNG implementation, Socket linked stealer activity, and the BNB Smart Chain resolver to help connect the remaining lineage and infrastructure gaps. 

• RemotePanel and BoundSiphon reflect a broader shift toward modular malware ecosystems that separate persistent access from data theft, allowing operators to replace infrastructure and individual components while retaining the underlying capabilities needed to continue an operation. 

• For victims, a single successful infection can lead to persistent remote access and theft of credentials, browser sessions, cryptocurrency wallets, password manager data, and other sensitive information, increasing the risk of account takeover, fraud, and continued compromise. 

• Blackpoint has detections in place for key behaviors across the infection chain, providing coverage even as individual payloads and infrastructure change. 

Executive Summary

Blackpoint’s Adversary Pursuit Group (APG) identified two previously undocumented .NET malware components delivered through the same ClickFix infection chain, being tracked as RemotePanel and BoundSiphon. RemotePanel provides persistent remote access and centralized control over infected systems, while BoundSiphon focuses on rapidly collecting credentials, browser sessions, cryptocurrency wallets, password manager data, and other high value information. 

The observed infection began with a user executing a ClickFix command that retrieved additional instructions through native Windows tooling. The chain then escalated privileges, weakened Microsoft Defender protections, and deployed both payloads through separate execution paths. RemotePanel was installed for persistence and continued access, while BoundSiphon was loaded directly into memory and began collection without establishing persistence of its own. 

RemotePanel is built as a broader remote access platform rather than a simple command shell. It supports interactive PowerShell, file and process management, screen access, modular HVNC, and centralized management of multiple infected systems. Its backend includes operator permissions, campaign and build segmentation, mass tasking, relay management, victim tagging, and audit functionality. The RAT also uses a BNB Smart Chain contract to retrieve its active Command and Control (C2) address, allowing the backend to move without requiring changes to the implant. 

BoundSiphon handles the collection side of the operation. It targets Chromium and Firefox credentials, cookies, cryptocurrency wallets, password manager data, selected documents, and host information. Its support for Chromium App-Bound Encryption is especially notable. BoundSiphon moves its decryption logic into a legitimate Chromium process, allowing it to recover protected key material used by newer browser versions. 

APG also identified strong overlap between BoundSiphon and a .NET stealer previously documented by Socket in May 2026. The earlier sample shares the same browser decryption components, injection framework, network protocol, and unusual build metadata. The infrastructure and configuration observed in this campaign have changed, but the similarities indicate that BoundSiphon comes from the same stealer codebase or builder lineage. 

Several questions around the tooling remain unresolved, including how far back RemotePanel extends, whether related BoundSiphon builds have appeared under different names, and how broadly the two components have been deployed together. If any of the behaviors, code artifacts, infrastructure, or lineage described in this report look familiar, APG would love to compare notes with other researchers and continue connecting the activity. 

More Than the Sum of Its Parts 

RemotePanel and BoundSiphon point to a broader shift toward malware ecosystems designed around specialization, scalability, and the ability to adapt when individual parts of an operation are disrupted. Rather than relying on one payload to handle access, persistence, and collection, this deployment separates those functions between a persistent remote access platform and a stealer built to collect high-value data quickly. RemotePanel’s fleet management, operator permissions, modular HVNC, and blockchain-based C2 resolution further suggest a platform designed to support continued operations across multiple compromised systems, while BoundSiphon’s ability to work around Chromium App-Bound Encryption shows that credential theft tooling is continuing to adapt alongside improvements in browser security.  

The separation between RemotePanel and BoundSiphon also gives the operation flexibility to evolve individual capabilities without fundamentally changing how the broader deployment works. BoundSiphon shows strong overlap with an earlier stealer codebase despite changes in infrastructure and configuration, while RemotePanel’s modular design allows capabilities such as HVNC to be updated independently of the core implant. Future iterations are, therefore, likely to look different at the payload or infrastructure level while retaining many of the behaviors and architectural relationships observed in this campaign.  

Technical Analysis 

Finger Points the Way In

The infection began with ClickFix, where the user was socially engineered into executing a PowerShell command that eventually launched cmd.exe with a for /f loop. That loop called finger.exe against dfgwertvads23@leftsideegpeakk[.]com, with carets inserted throughout the utility name to make the command less obvious at a glance and break simple string based detections (Figure 1). 

In this case, finger.exe was used as a lightweight way to pull the next command from attacker controlled infrastructure and pass it back into the execution chain. From there, execution moved into dead.fik, the first stage APG recovered that handled privilege escalation. 

dead.fik then abused CMSTPLUA, a Windows COM component that can be used to start a process with elevated privileges. The script used it to launch a hidden high integrity PowerShell process, which was also visible in endpoint telemetry through dllhost.exe running with the CMSTPLUA CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} (Figure 2). 

dead.fik also created a temporary file matching %TEMP%\elv_<GUID>.txt to pass output between the original and elevated processes. The parent process waited for the file to appear, read the contents, and removed it once the elevated command completed. Even though the file is short lived, it leaves behind a useful host artifact when the script itself is no longer available. 

With elevation complete, PowerShell moved into the next staging layer on cdnprog.b-cdn[.]net. Telemetry captured a request for monitorM.png, while the recovered dead.fik script referenced monitor.png on the same host. Despite the image extension, this resource was part of the staging chain. The monitor stage then prepared the endpoint for the next phase of the infection by removing scheduled tasks and adding broad Microsoft Defender exclusions covering the system drive, common staging directories, executable extensions, and processes including regasm.exe and svchost.exe (Figure 3). 

Divide and Deploy

Once elevated, the monitor stage pulled W32Time.xpg and St_vd.xpg from the same Bunny CDN staging host. Although the two files ultimately serve very different purposes, both are wrapped using the same lightweight byte subtraction scheme. The staging script repeats the ASCII string Rfc2898DeriveBytes across the encrypted data and subtracts those values to reconstruct the original payload. Despite the name, this is not actually using the .NET Rfc2898DeriveBytes class or PBKDF2. The string is simply being reused as a repeating byte sequence to obscure the files before execution (Figure 4). 

From there, the two components take very different execution paths. The W32Time branch is written to %ProgramData% under a random numeric filename before being padded to roughly 751 to 799 MiB. The actual executable remains intact at the beginning of the file, while hundreds of megabytes of zeroes are appended to the end. Windows can still execute it normally because the added data does not change the executable itself, but the unusually large file makes routine sample collection, sandbox submission, and automated scanning more cumbersome (Figure 5). 

BoundSiphon takes the opposite approach. Rather than restoring the stealer to disk, St_vd.xpg is decrypted directly into memory and passed to Reflection.Assembly.Load(). In practical terms, PowerShell loads the recovered .NET assembly straight from a byte array, allowing BoundSiphon to begin running without first creating a normal executable file on disk. 

That difference reflects what each component is meant to do later in the infection. The W32Time branch needs a durable presence because it installs the watchdog responsible for maintaining RemotePanel, while BoundSiphon is designed to run quickly, collect data, and leave persistence to the RAT.  

Component	Execution model	Primary role
W32Time / RemotePanel	Written to disk, inflated, and installed as a service	Persistent remote access and operator control
St_vd / BoundSiphon	Loaded directly into memory through PowerShell	Credential, session, wallet, and document collection

Clocked In

The W32Time branch acts as both a persistence mechanism and a watchdog for RemotePanel. Its command line exposes three execution paths: –loveputin installs the service, –donbass removes it, and launching the executable without either switch enters its normal Windows service mode. The monitor stage starts the padded W32Time executable with –loveputin, beginning the persistence process (Figure 6). 

Once installed, the watchdog copies itself to C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\svchost.exe, marks the file as Hidden and System, and registers it as an automatically starting service masquerading as Windows Time. This gives the malware a way to restart with Windows while blending into a service name and file path that appears system related. 

The watchdog also calls RtlSetProcessIsCritical, a Windows function that can mark a process as critical to the operating system. Normally, Windows reserves this behavior for processes whose unexpected termination could leave the system unstable. W32Time clears that status during a normal shutdown, but abruptly terminating it while the flag remains set can cause Windows to crash. This adds another obstacle for anyone attempting to simply kill the watchdog process. 

Inside W32Time is a second .NET executable encrypted with AES-256-CBC. APG decrypted the embedded payload and recovered a 64-bit RAT whose own version metadata identifies the product as RemotePanel. That embedded metadata provided the name used throughout this analysis rather than relying on a label assigned from its behavior (Figure 7). 

Rather than starting RemotePanel as a normal standalone process, the watchdog places it inside regasm.exe, a legitimate Microsoft .NET utility. To do this, it first obtains a security token associated with the logged in user’s interactive session, preferring explorer.exe before falling back to other processes. In simple terms, that allows the watchdog, which is running as a service, to start RemotePanel in the desktop session where the user is actually logged in. 

The loader requests several Windows privileges to make that possible, including SeDebugPrivilege, SeImpersonatePrivilege, and SeAssignPrimaryTokenPrivilege. It then creates regasm.exe on the interactive desktop and maps RemotePanel into that process rather than launching the RAT under its own executable name. This gives RemotePanel a legitimate Microsoft process to run inside while still allowing it to interact with the user’s session. 

The watchdog continues checking the RemotePanel process after launch and starts it again if it disappears. That behavior also ties directly back to the earlier staging activity: before W32Time ever reaches this point, the monitor script has already added regasm.exe to Microsoft Defender exclusions. The initial staging and persistence components therefore work together to prepare the process that later becomes RemotePanel’s long term host.  

Remote Control, Fully Loaded

Once established, RemotePanel gives the operator considerably more than a basic remote shell. The RAT supports interactive PowerShell, file and process management, screen streaming, and modular HVNC, while the backend adds the functionality needed to manage multiple infected systems from the same control platform. That includes separate operator accounts, victim tagging, campaign and build tracking, relay management, audit records, Telegram notifications, and the ability to send PowerShell tasks across groups of systems. 

Victim sessions begin over a direct TCP connection using a simple length prefixed message format. The length value tells RemotePanel how much data belongs to each message, allowing the client and server to separate individual packets as they move across the same connection. During the initial handshake, RemotePanel generates a fresh 256 bit AES session key and sends information including its campaign key, HWID, username, build identifier, timestamp, and the new session key to the server (Figure 8). 

The initial message uses both RSA and AES encryption. At a high level, RSA protects the temporary key material needed to start the connection, while AES is used for the actual session data once the server accepts the victim. This gives every connection its own encryption key rather than relying on one static key shared across all infected systems. 

RemotePanel also creates an HWID, or host identifier, from the victim’s Windows domain, username, and disk serial number. That identifier allows the backend to recognize the same system across reconnects and associate it with information such as its build, campaign, country, first and last seen timestamps, tags, comments, and current operator status. The backend also defines Guest, User, and Admin roles with granular permissions, allowing different operators to be given access to specific capabilities rather than unrestricted control of the entire platform (Figure 9). 

Most RemotePanel commands use the AES protected session established during the handshake, but not every message follows that path. Screen frames and file chunks can be transferred outside the normal AES message layer, likely avoiding the additional processing cost of encrypting large volumes of data through the same packet routine. Screen streaming also uses QOI, a lightweight image format, alongside tiled updates so the RAT can send changed regions of the screen instead of repeatedly transmitting an entire screenshot. 

The RAT’s HVNC capability is also kept separate from the core implant. HVNC, or hidden virtual network computing, gives an operator an interactive desktop session that can remain separate from what the victim sees on their own screen. Rather than embedding the entire module inside RemotePanel, the backend sends it to the victim as a Base64 encoded module along with its own port, authentication token, and session key. That design allows the operator to replace or update the HVNC component without rebuilding the main RAT (Figure 10). 

RemotePanel’s backend extends the same model beyond individual victim sessions. Operators can scope systems by campaign key, build, country, or HWID, maintain tags and comments, manage relays, and distribute PowerShell jobs across multiple matching victims at once. The result is less like a traditional one to one RAT session and more like a shared platform for maintaining and operating a larger collection of compromised systems. 

RemotePanel Area	What it Enables
Interactive access	PowerShell sessions, screen streaming, file management, process control
HVNC	Server delivered module with independent token and session material
Campaign control	Keys, build IDs, country and HWID scoping, victim tags and comments
Operator management	Guest, User, and Admin roles with granular permissions and audit logs
Fleet tasking	Mass PowerShell jobs filtered by build and country, plus relay management

Chain of Command

RemotePanel does not need a permanent C2 address embedded in the RAT. Unless the local GHOST_HOST, GHOST_PORT, or GHOST_HVNC_PORT overrides are present, the client queries a hardcoded BNB Smart Chain contract to determine where it should connect. 

Rather than using the blockchain itself for C2 traffic, RemotePanel treats the contract more like a small configuration store. The RAT sends an eth_call request, a read only blockchain query that does not create a transaction, and invokes getDomain() to retrieve the current backend address. The returned value can contain either a host or a host:port pair, with RemotePanel defaulting to TCP 443 when only a host is provided (Figure 11). 

When APG queried the contract during analysis, getDomain() returned 193.233.75[.]7, making 193.233.75[.]7:443 the active RemotePanel backend at that time. The important distinction is that the contract is not the C2 server itself. It simply tells infected systems where the actual RemotePanel server is located. 

The contract is intentionally simple. Its runtime exposes owner(), getDomain(), setDomain(string), and transferOwnership(address). The owner is the wallet permitted to change the configuration, while setDomain() allows that wallet to replace the stored backend address. During analysis, the controlling wallet was 0x481983529a4f9dae46bf451cf6a2b23d7dac1fea (Figure 12). 

Contract Function	Role
owner()	Returns the wallet that controls the resolver
getDomain()	Returns the current RemotePanel backend
setDomain(string)	Allows the owner to rotate the backend without rebuilding the RAT
transferOwnership(address)	Moves control of the resolver to a different wallet

This gives the operator a straightforward way to move infrastructure without rebuilding or redistributing RemotePanel. If a backend needs to change, the operator can update the value stored in the contract and existing victims will receive the new address the next time they resolve it. The hardcoded contract can remain the same even as the server behind it changes. 

The local GHOST variables provide a second path around that resolver. A host, C2 port, or HVNC port can be supplied directly, allowing the same RemotePanel build to use alternate infrastructure without relying on the blockchain value. This could support testing or other deployment configurations while leaving the underlying RAT unchanged. 

Borrowing the Browser’s Keys

The second payload, being tracked as BoundSiphon, is a .NET stealer focused on collecting credentials, browser sessions, cryptocurrency wallets, password manager data, selected documents, and basic host information. The restored build identifies itself as New-V1, is protected with .NET Reactor and Necrobit, and communicates with greatgrgreeng[.]com. Unlike RemotePanel, BoundSiphon does not establish its own persistence. It is loaded into memory, collects the data it is interested in, sends the results to its backend, and exits. 

While reversing the stealer, APG identified strong overlap with we4ftg.exe, a .NET stealer documented by Socket in May 2026 after it was distributed through malicious NuGet packages. The two samples share several unusually specific implementation details, including the same BrowserKeyDecryptor and SharpInjector components, support for Chromium v10 and v20 key recovery, /check and /upload endpoints, randomized HTTP header names, and the same unusual WERHBQAER5GE product metadata and version information. The infrastructure and configuration have changed, but that level of overlap points to the same stealer codebase or builder lineage rather than unrelated malware using similar techniques (Figure 13). 

Before collection begins, BoundSiphon sends a POST request to /check and expects the server to respond with HTTP 418. Although 418 is normally the joking “I’m a teapot” HTTP status code, here it acts as a simple gate confirming that the expected backend is responding before the stealer continues. Collected data is then sent to /upload, with different upload types identifying the kind of information being transmitted.  

The stealer also randomizes portions of its HTTP header names on each request. The names change, but embedded markers still identify information such as the New-V1 build, the backend authentication value, and the type of data being uploaded. This provides some superficial variation between requests without changing the underlying protocol (Figure 14). 

The collection itself covers both Chromium and Firefox browsers along with a broad set of cryptocurrency and password management applications. BoundSiphon targets saved credentials and cookies, browser encryption keys, wallet applications and extensions, password manager extensions, selected files from common user directories, and basic system information. 

The most technically interesting part of BoundSiphon is how it handles newer Chromium credentials protected by App Bound Encryption. Older Chromium secrets could often be decrypted after stealing the browser database and recovering a DPAPI protected master key. Newer v20 credentials add another layer by tying access to protected key material more closely to the browser and its elevation service, making simple offline decryption less effective.  

BoundSiphon works around that restriction by moving the decryption operation into a legitimate Chromium process. It starts a temporary browser process with its own user data directory and reduced sandbox restrictions, then uses SharpInjector to load the stealer’s managed .NET code inside that browser. Instead of trying to impersonate Chromium from the outside, the malware lets a real browser process request access to the protected key and passes the recovered result back to BoundSiphon (Figure 15). 

APG recovered both 32 bit and 64 bit versions of the small native SharpInjector loader. These components do not represent separate malware payloads. Their job is to start the .NET runtime inside the target browser process, load BoundSiphon’s managed assembly from memory, and invoke the requested decryption routine. The source also includes WoW64 helpers and an 89 byte Heaven’s Gate transition stub, which allows the injection framework to handle situations where 32 bit and 64 bit processes need to interact. The analyzed New-V1 build itself is 64 bit, so that cross architecture path is not required during every infection.  

Firefox is handled through a separate path. BoundSiphon locates Firefox profiles and loads nss3.dll, part of Firefox’s own cryptographic framework, to decrypt stored credentials using the same libraries the browser normally relies on. Wallet collection covers both desktop applications and browser extensions, while password manager targeting includes extensions such as 1Password, LastPass, and Bitwarden. 

Loose Threads, Open Questions

Several artifacts recovered across RemotePanel and BoundSiphon point toward a possible Russian speaking development or operational context, but none are sufficient for attribution on their own. 

BoundSiphon contains an AntiSNG routine that checks for the Russian keyboard layout identifier 0x0419 and exits if it is present. APG did not identify an active caller for CheckAndExitIfRussian() in the analyzed build, suggesting the logic may be dormant, inherited, or retained from an earlier version of the stealer. The naming is also notable, with SNG corresponding to the Russian abbreviation СНГ for the Commonwealth of Independent States. The W32Time wrapper adds its own artifacts through the –loveputin and –donbass command line switches. These strings are not attribution evidence by themselves, but they are worth preserving alongside the exclusion logic as potential lineage or developer context (Figure 16). 

BoundSiphon also provides a strong pivot into earlier activity. Its BrowserKeyDecryptor, SharpInjector framework, Chromium v10 and v20 key recovery, /check and /upload protocol, randomized header construction, and unusual build metadata closely overlap with we4ftg.exe, the stealer documented by Socket in May 2026. The current infrastructure and configuration are different, but the implementation overlap points to the same stealer codebase or builder lineage. What remains unclear is whether the current deployment reflects the same operator, a shared builder, or reused tooling. 

The infrastructure leaves another open thread. RemotePanel currently resolves its backend through the BNB Smart Chain contract, which returned 193.233.75[.]7:443 during analysis. Because the contract owner can update that value independently of the implant, the backend may move while the malware remains unchanged. The earlier Socket linked stealer used separate infrastructure, providing another pivot point without establishing a direct operational connection. 

RemotePanel’s infrastructure design indicates the operators likely anticipated the need to replace backend infrastructure over the lifetime of the malware. Separating C2 resolution from the implant allows existing infections to follow the changes without requiring a new build or another delivery attempt. The local configuration options provide additional flexibility in how deployments get managed. These factors could allow RemotePanel activity to continue through infrastructure changes that would otherwise likely disrupt access to previously compromised systems. 

APG has enough evidence to connect BoundSiphon to an earlier stealer lineage and identify several unusual regional and infrastructure artifacts, but not enough to determine who developed, distributes, or operates the tooling. It is also unclear how far back RemotePanel itself extends, whether related builds exist under different names, or how broadly the two components have been deployed together. 

If any of this looks familiar, we’d love to hear from you. Researchers who have seen RemotePanel, related BoundSiphon builds, the same AntiSNG implementation, Socket linked samples, the BNB Smart Chain resolver, or connected infrastructure may have the piece that helps tie more of this activity together. Reach out, share what you’ve seen, and let’s compare notes. 

Conclusion 

RemotePanel and BoundSiphon serve two distinct roles within the same deployment. RemotePanel provides persistent access and centralized control, while BoundSiphon focuses on quickly collecting credentials, browser sessions, cryptocurrency wallets, password manager data, and other valuable information. Their delivery and execution paths reflect those roles, with the W32Time branch establishing a durable foothold while BoundSiphon runs primarily from memory and leaves persistence to the RAT. 

What makes the toolkit notable is how much flexibility sits behind that separation. RemotePanel can move its backend through an owner controlled BNB Smart Chain resolver without rebuilding the implant, while BoundSiphon moves its App Bound Encryption recovery into legitimate Chromium processes to reach newer browser secrets. Combined with the shared staging, Defender exclusions, service persistence, and modular RemotePanel backend, the result is a deployment built to maintain access while continuing to adapt around changes in infrastructure and browser protections. 

How Blackpoint Reduces Exposure 

Blackpoint reduces exposure to this activity through behavior based detection, continuous monitoring, analyst investigation, and rapid response across the intrusion lifecycle. This gives the SOC multiple opportunities to identify and contain malicious activity before it develops into persistent access or credential theft. 

As an MDR provider, Blackpoint can correlate related endpoint activity, investigate suspicious behavior in context, contain affected systems, and hunt for additional signs of compromise across the environment. That coverage is designed to remain effective even when operators rotate infrastructure, rebuild payloads, or change individual indicators. 

By focusing on durable attacker behaviors instead of short lived hashes and domains, Blackpoint helps customers maintain protection as the campaign evolves. 

Recommendations 

• Reduce the impact of ClickFix social engineering. Train users never to paste commands into PowerShell, Command Prompt, or the Windows Run dialog when prompted by a website, CAPTCHA, support page, or browser message. 

• Restrict PowerShell and script execution. Use Group Policy, application control, and constrained administration policies to limit unapproved PowerShell and script execution, particularly for standard users. 

• Enforce application control. Use WDAC, AppLocker, or equivalent controls to prevent unapproved binaries and scripts from running from user-writable locations such as %TEMP%, %APPDATA%, and %ProgramData%. 

• Eliminate unnecessary local administrator access. Keep users operating as standard users and reserve privileged access for dedicated administrative accounts to reduce the impact of privilege escalation attempts. 

• Restrict unnecessary outbound access. Use DNS and web filtering to block newly registered, uncategorized, and low-reputation domains. Limit access to public blockchain RPC infrastructure where it is not required for business operations. 

• Remove unnecessary legacy Windows utilities. Disable or remove tools such as finger.exe where they are not required for business operations, reducing the number of native binaries that can be repurposed for command delivery. 

Indicators of Compromise

File Indicators

Artifact	SHA-256	Context
W32Time stage	5060c8184993d5ac04701ffa2c1d30451e40a7b2dbfc084eceaabb5084704991	Watchdog and RemotePanel loader
St_vd stage	30f9387b6aa2dd249d93cec58786251a224faaec57673a4b8104a33a01dfe62b	BoundSiphon stealer
Embedded RemotePanel	b7a5c52cedd9cd5425a7f85b8d3b4b869b805c70c7991375a2c4ab612ff7906d	Decrypted .NET RAT
SharpInjector x86	351f0d27d2f0105186446693eed5794419ad79d7e6e647fc2fe74dbffb25f9ad	BoundSiphon native CLR loader
SharpInjector x64	a7e8c9e157d3ce37913a32aaa861b5248da4cc5288fa99a6b291524af5e3b9c6	BoundSiphon native CLR loader
Heaven’s Gate thunk	fec29bbd8e50b6635ef683f03f6e018c9627aa6362a2f167115424e50b8c1b10	Cross bitness transition helper

Host Indicators

Type	Indicator	Context
Temp file	%TEMP%\elv_<GUID>.txt	CMSTPLUA output channel
Service binary	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\svchost.exe	W32Time watchdog persistence
Process	regasm.exe	RemotePanel injection host
Switch	–loveputin	W32Time install path
Switch	–donbass	W32Time uninstall path
Environment	GHOST_HOST / GHOST_PORT / GHOST_HVNC_PORT	RemotePanel local overrides
Build ID	MRMN_v1	RemotePanel build identifier
Build ID	New-V1	BoundSiphon build identifier

Network and Blockchain Indicators

Type	Indicator	Context
Domain	leftsideegpeakk[.]com	ClickFix Finger command delivery
Finger query	dfgwertvads23@leftsideegpeakk[.]com	Remote command retrieval
Domain	cdnprog[.]b-cdn[.]net	PowerShell and .xpg staging
URL path	/google/dead.fik	Recovered elevation stage
URL path	/google/monitor.png	Recovered monitor-stage reference
URL path	/googleads/monitorM.png	Monitor-stage path observed in process telemetry
URL path	/googleads/W32Time.xpg	RemotePanel loader
URL path	/googleads/St_vd.xpg	BoundSiphon
Domain	greatgrgreeng[.]com	BoundSiphon backend
Endpoint	/check and /upload	BoundSiphon preflight and exfiltration
IP	193.233.75[.]7:443	RemotePanel backend returned by resolver during analysis
BSC contract	0x2A8f205C8A6616a1D34C47F6172C16b20917253C	RemotePanel C2 resolver
BSC owner	0x481983529a4f9dae46bf451cf6a2b23d7dac1fea	Resolver controller wallet