Trend Micro researchers identified “NetDooka,” an emerging malware framework still in its early development phase that is distributed via a pay-per-install (PPI) malware distribution service called “PrivateLoader.” PrivateLoader, first discovered by Intel471 in February 2022, is a “downloader responsible for downloading and installing multiple malware into the infected system,” as a part of the service. This service relies on search engine optimization (SEO) poisoning as well as laced software downloads uploaded onto torrent sites and has a history of distributing a wide array of malware. NetDooka is composed of various parts, including a loader, a dropper, a protection driver, and a remote access trojan (RAT) that implements its own network communication protocol. The infection begins with the download of PrivateLoader followed by the installation of the NetDooka dropper component, which is responsible for decrypting and executing the NetDooka loader. Next, the loader performs checks to ensure no virtual environments are running and downloads an additional malware dropper (and potentially a kernel driver) from its remote server. The loader also de-obfuscates strings, including the command-and-control (C2) address, and checks for command-line arguments that were passed (which have been observed uninstalling various programs, renaming the dropper component, and locking antivirus vendor domains). The downloaded dropper is responsible for decrypting and executing the final NetDooka payload: the RAT. The RAT can start a remote shell, gain browser data, take screenshots, and exfiltrate system information. It also has the potential to run the installed kernel driver to “protect the dropped payload.” While NetDooka is still early in development, its capabilities “allow it to act as an entry point for other malware,” and researchers will likely continue to monitor it for additional features added during its evolution. An in-depth technical analysis of NetDooka as well as indicators of compromise (IOCs) can be viewed in Trend Micro’s report linked below.