June Detection Highlights: New Config Extractors, an EvilProxy Phishkit Detection Set, and 30+ New YARA Rules

Threat actors don't sit still, and neither does detection engineering. Each month, VMRay Labs ships a steady stream of new VMRay Threat Identifiers (VTIs), malware configuration extractors, and YARA rules — built directly from samples observed in the wild. June's updates cover four areas worth a closer look: a refined detection for vulnerable Office controls, a technique used to evade the Windows Defender emulator, a phishkit detection set built around EvilProxy-style credential harvesting, and a newly identified PowerShell loader that hides its code inside environment variables.

This post walks through what changed, why it matters, and what a live detonation of the new loader — internally named NTH Loader — actually looks like inside the VMRay platform.

A Sharper View Into Suspicious Office Controls

Office documents can embed interactive objects — buttons, checkboxes, text boxes, scroll bars — using COM-based controls. Two types matter most from a security perspective: ActiveX controls and OLE (Object Linking and Embedding) objects, which let one file type be embedded inside another. A PDF inside a Word document. A spreadsheet inside a presentation.

These mechanisms have legitimate uses. They're also a known path for hiding malicious payloads inside documents that otherwise look unremarkable, or for triggering exploits in vulnerable controls.

VMRay already extracts and analyzes every embedded control when an Office document is submitted, flagging any that are associated with known vulnerabilities. What changed in June is how that information surfaces. Instead of requiring an analyst to dig through the full report to locate which controls were extracted and which CVEs they're tied to, the updated VTI description now lists that detail directly in the dropdown — giving analysts a faster read on whether a document warrants deeper investigation.

Detecting Attempts to Evade the Windows Defender Emulator

Windows Defender doesn't just scan files. Before running an unfamiliar executable, it often passes the file through a built-in emulator: a lightweight environment that traces the first several instructions to assess whether the file looks malicious, without the overhead of full execution.

Emulators trade completeness for speed, and that trade-off creates an opening. Because an emulator only implements a subset of real system behavior, it leaves fingerprints — and threat actors have learned to look for them.

VMRay's threat analysis team observed this directly in SquidLoader, which calls the undocumented Windows API function NtQuerySystemInformation to check the system's uptime, since emulators often report unusual or default values. By comparing the return value against what a real environment would produce, the malware can determine whether it's executing inside Defender's emulator. If it detects the emulator, it stays quiet. If the check indicates a real machine — or a full sandbox environment — the malicious behavior runs as intended.

NTH Loader: PowerShell Hidden in Environment Variables

The most technically interesting addition this month is a detection for a previously untracked loader family, which VMRay's team has named NTH Loader based on its core technique: storing and executing PowerShell code through environment variables.

Environment variables are simple key-value pairs that describe a system or user's current session — the kind of thing referenced casually in a command like $env:username. NTH Loader takes a PowerShell script that might run to hundreds of lines, splits it into chunks, and writes each chunk into its own environment variable. At runtime, the script reconstructs itself by reading and joining those variables back together before execution.

The payoff for the attacker is straightforward: static analysis tools that scan a file or a single command line only ever see a fragment of the full code. The complete logic only exists, briefly, in memory — assembled at the moment of execution. That's a meaningful evasion advantage against tools that don't observe runtime behavior.

Together, the VTI and YARA rule give analysts a reliable signal even when the reconstructed script itself isn't immediately readable in a static view.

Catching Brand Impersonation Behind RMM Tool Downloads

Remote monitoring and management (RMM) tools are standard equipment for IT teams managing fleets of machines remotely. They're also, increasingly, standard equipment for attackers — who use the exact same legitimate software to gain remote access, establish persistence, and run arbitrary commands, all while blending into traffic that looks like routine IT operations.

The tool itself isn't the signal. The context around how it arrived is. VMRay's team has observed a pattern: phishing emails linking to pages that impersonate well-known brands — software vendors, document services — solely to push a download of an RMM tool, dressed up as something legitimate.

A Three-Part Detection Set for EvilProxy-Style Phishkits

Adversary-in-the-middle phishing platforms like EvilProxy don't rely on a single tell. They combine several smaller behaviors that, individually, look almost legitimate — and only become meaningful together. VMRay's team built three new lower-scoring VTIs around exactly this pattern, each contributing a separate signal toward one composite phishkit detection.

New Config Extractors: Setoprot (RHClient2) and Gh0st RAT

VMRay added two new malware configuration extractors this month, both responding to observed increases in sample volume.

The first targets Setoprot — also tracked as RHClient2 — a .NET-based remote access trojan and infostealer. Rising sample counts for this family prompted the team to build a dedicated extractor that pulls high-quality, structured IOCs directly from detonated samples.

The second targets Gh0st RAT, a family with an unusually long shelf life. First observed in 2008, Gh0st RAT remains heavily used today — largely because its source code was leaked publicly years ago, spawning countless forks and variants still circulating in the wild. A dedicated configuration extractor ensures samples from any of those variants yield the IOCs analysts need, regardless of which fork is in play.

30+ New YARA Rules

Beyond the new VTIs, VMRay shipped more than 30 new YARA rules in the past month, spanning several categories: detections for previously unseen spyware families alongside updates to existing ones, new loader signatures, and additional phishing page rules.

One detail worth calling out: improved detection coverage for ClickFix pages specifically targeting macOS users. ClickFix — the social engineering technique that tricks users into pasting and running a malicious command themselves — has historically concentrated on Windows targets. VMRay's team has observed a noticeable rise in ClickFix variants built specifically for macOS, and the new YARA rules reflect that shift. The remaining additions cover APT-linked infrastructure and recently observed exploits.

Watching NTH Loader Detonate

To show how these detections come together in practice, VMRay's threat analysis team walked through a live analysis of a real NTH Loader sample — an MSI installer submitted to the platform shortly before the session.

The verdict came back immediately: malicious, classified as a downloader, with a threat name pulled directly from the new YARA rule. The VMRay Threat Identifiers told the story from there. At the top, the YARA detection — triggered across multiple artifacts, including dropped files and extracted function strings. Just below it, the new Defense Evasion VTI: PowerShell execution sourced from environment variables, with the report noting that Windows Explorer had spawned the PowerShell process responsible.

Following the process anchor led directly to the relevant PowerShell command line — invoked with a hidden window switch and a call to Invoke-Expression referencing an environment variable named _setD. That variable name doesn't exist on a clean system. Its presence alone is a strong indicator of attacker-introduced code, even before any further analysis.

What's notable is that the platform didn't need to fully reconstruct or deobfuscate that script to deliver value. The dynamic analysis captured every behavior the script triggered regardless: file operations, process creation, registry changes, and outbound network connections to a specific domain and a small set of IP addresses — all logged and available, independent of whether the obfuscated PowerShell itself was ever read in plain text.

Tracing the source of that environment variable led up through the full process tree: an MSI installer triggering a custom action, which executed a VBScript, which in turn executed a second VBScript, which ultimately launched a batch script — re-invoked later with a /launched argument. The batch script and the VBScript that spawned it turned out to be interdependent: the batch file read portions of the VBScript's own comments to assemble its logic, a layering of scripting engines that would be genuinely difficult to untangle through static analysis alone.

For analysts who want to go further, VMRay's function log provides a complete record of every API call made during execution — including each SetEnvironmentVariable call, the exact value set, and the timestamp. A short parsing script run against that log reconstructed the full PowerShell payload from its scattered environment-variable fragments. The same content is also available more directly through VMRay's function strings output, which surfaces plaintext strings passed to Windows API calls during execution — no custom parsing required.

Why This Matters for Detection Engineering

The pattern across June's updates is consistent. Evasion techniques are getting more specific — fingerprinting an emulator's quirks, splitting code across dozens of environment variables, embedding one brand's interface inside another's page — and detecting them requires equally specific behavioral signals, not broad heuristics alone.

VMRay's weekly detection cadence exists to keep pace with that specificity. Each VTI, config extractor, and YARA rule released this month traces back to samples the team has actually observed and analyzed — not theoretical coverage, but detection built from what's currently moving through the threat landscape.

The full detection set, including the new VTIs and YARA rules covered here, is available now to VMRay customers.