django88@django88_

Aug 28

Elastic Security Labs

@elasticseclabs

Aug 28

We reverse engineered malware built to kill our own EDR.

In August 2026, eSentire documented a ClickFix campaign selling a DLL sideloader as a service.

It drops a malicious mscoree.dll next to a signed Microsoft binary, vb7to8.exe. Windows loads the planted copy first. Attacker trusted process.

The kit also ships a vulnerable driver (BYOVD) to disable EDR, including Elastic Endpoint.

So we rebuilt it. A NativeAOT .NET 7 library, exports faked, a module initializer that fires on load.

We dropped it beside vb7to8.exe and ran it.

Elastic Defend 9.5.0 flagged the load as DLL Hijack: Masquerading.

Detecting this before 9.5.0 took ~88 lines and a list of ~2,600 library names. Now it's one line.

MITRE ATT&CK: T1574.001 (Hijack Execution Flow: DLL), T1036 (Masquerading).

Reverse engineering walkthrough, the .NET rebuild, and the detection breakdownby @0xfluxsec and @django88_: go.es.io/4xw6o5G

Original campaign research by @eSentire.