Cracked-Software Lure Bundles Three RAT Families From One Build Pipeline

A Cracked-Software Trap Built From Three RAT Families and One Shared Build Pipeline

A trojanised archive circulating under the name "Onimai 1.7.1" — presented to prospective victims as a cracked copy of a software application — packages three distinct remote-access trojan families into a single deployment bundle, all compiled from what the evidence indicates is a unified .NET build pipeline and routed through the playit.gg public tunnelling service to a self-signed command-and-control node registered in the Seychelles but geolocated in Germany. The campaign's operational fingerprint is unusually coherent for commodity-RAT tradecraft: four PE payloads spanning QuasarRAT, XWorm, and a Marte/VenomRAT dropper share an identical PE import-table hash — imphash f34d5f2d4577ed6d9ceec516c1f5a744 — binding them to a single builder or operator despite their functional diversity. The lure infrastructure was staged as early as September 2024, more than six months before the payload wave arrived in March and April 2025, and a PowerShell component surfaced a further six months after that, suggesting an operator who treats this deployment as an iteratively maintained toolkit rather than a disposable one-shot campaign.

CTX Team has classified this cluster at severity 100, confidence 85, based on five PE and DLL files carrying high VirusTotal consensus (49 to 62 detections each), multi-sandbox verdicts, and named family tags, alongside three supporting configuration files that carry zero detections and serve as contextual artefacts rather than independent threat signals. The sole network indicator — 158.94.208.102 in AS202412 (Omegatech LTD) — has moderate detection at 19/91 but no corroborating domain infrastructure, which limits C2 attribution confidence to that single node.

The build author handle "MrThunker" appears in copyright strings on two payload files — the primary dropper (Onimai.exe, 4e90fa3f) and the cracked-variant dropper (21871f41) both carry "Copyright © MrThunker 2024" in their signing metadata — representing the only operator identity signal in the campaign. The use of cracked-software lures, commodity RAT families available on underground markets, and a low-cost tunnelling service is consistent with financially motivated or opportunistic access-broker activity, though current evidence is too thin to conclude victim sector or monetisation method.

The Lure: Staged Infrastructure and a Six-Month Head Start

The campaign's initial-access mechanism [T1204.002] is a trojanised archive presented as a cracked copy of "Onimai 1.7.1", distributed under filenames including "Onimai Cracked by MaximsRu.exe". The package is structurally convincing: it contains a launcher configuration file (OnimaiLauncher.exe.config), a settings XML, and a client-list JSON alongside the malicious executables, giving the appearance of a functional application to users seeking pirated software. Archive extraction paths observed across multiple samples place the bundle under %TEMP%\Onimai 1.7.1\, consistent with a standard self-extracting or ZIP-based delivery mechanism targeting Windows systems.

The most analytically significant timing detail is the gap between the lure infrastructure and the payloads. The launcher configuration file (37acba9e) first appeared on VirusTotal on 2024-09-09 — carrying zero detections across 78 engines and tagged simply as XML — while all four malicious PE payloads first appeared between 2025-03-23 and 2025-04-02, a gap of roughly six months. The settings XML (b4141e054815) and the Quasar.Common.dll component (d7a74254) share a first-seen date of 2025-03-26, placing them squarely in the payload deployment wave rather than the staging phase. This timeline indicates the operator assembled the lure packaging well before the RAT payloads were ready or deployed, suggesting deliberate pre-positioning of the delivery vehicle ahead of the operational campaign.

The three supporting files — OnimaiLauncher.exe.config, settings.xml, and clients.json — form what CTX Team's analysis labels the "Onimai package config/data files" cluster. All three carry zero AV detections and appear exclusively as co-extracted artefacts alongside the malicious PE files in the same Onimai 1.7.1 archive paths. They are the configuration and data layer of the package: the launcher config provides the .NET runtime binding redirects that make the application appear functional, the settings XML carries application parameters, and the clients.json (bbfcb879) — typed as PowerShell despite its JSON naming — is a contextual outlier that deserves separate treatment. The zero-detection status of these files is not a sign of benignity; it reflects the fact that XML and configuration files rarely trigger AV signatures regardless of their role in a malicious package.

The alt-name "Fake Onimai/OnimaiLauncher.exe.config" appearing in one submission path for the launcher config is a telling detail: it suggests at least one analyst or automated system had already identified the package as a fake before the payload wave arrived, though the file itself remained undetected by AV engines throughout.

Build Pipeline Cohesion: One Imphash Across Four Families

The strongest structural evidence binding this campaign together is the shared PE import-table hash. All four malicious PE payloads — the QuasarRAT client EXE (d24a538a, 637 KB), the XWorm plugin (b460ee74, 32 KB), the primary Onimai dropper (4e90fa3f, 8.1 MB), and the cracked-variant dropper (21871f41, 3.3 MB) — carry identical imphash f34d5f2d4577ed6d9ceec516c1f5a744. All four also share the same PEiD packer signature. In .NET MSIL assemblies, the import table is typically minimal and dominated by the CLR bootstrap imports, so imphash collisions across unrelated samples are not unusual in isolation — but the combination of identical imphash, identical packer signature, and the copyright string "Copyright © MrThunker 2024" appearing on two members of the set points strongly toward a single build template or builder kit producing all variants.

The size range across the four files — from 32 KB for the XWorm plugin to 8,128 KB for the primary dropper — reflects the different roles each plays in the deployment chain rather than independent provenance. The two large droppers carry the embedded payload bodies; the QuasarRAT client and XWorm plugin are the extracted runtime components. This is consistent with a builder that generates a wrapper dropper of variable size depending on what it embeds, while the embedded components themselves are compiled separately and share the same base import structure.

The Quasar.Common.dll (d7a74254, 72 KB) sits outside the imphash cohort — it carries a different imphash (dae02f32a21e03ce65412f6e56942daa) — but is tightly bound to the campaign through other axes. Its product string reads "Onimai Common", its copyright reads "Copyright © MrThunker 2024", its version is 1.7.1, and its alt-names place it in the same %TEMP%\Onimai 1.7.1\ extraction paths as the rest of the bundle. The YARA rule MAL_QuasarRAT_May19_1 (authored by Florian Roth / Nextron Systems, from the Neo23x0 signature-base repository) fires on the DLL alongside the QuasarRAT client EXE and the cracked-variant dropper — three files across the full execution chain from dropper to DLL component. The JPCERT/CC asyncrat memory-detection rule co-fires on both the QuasarRAT client EXE and the DLL, reflecting the well-documented code-sharing lineage between AsyncRAT and QuasarRAT and confirming these two files are functionally paired runtime components of the same RAT deployment.

The PE timestamps on the four imphash-cohort members are worth noting. The XWorm plugin (b460ee74) and the primary Onimai dropper (4e90fa3f) both carry a PE compile timestamp of 2025-04-02, matching their first-seen date exactly — a relatively clean signal. The QuasarRAT client (d24a538a) carries a PE timestamp of 2039-03-02, and the cracked-variant dropper (21871f41) carries 2071-10-13 — both clearly falsified future dates, a common .NET RAT technique to frustrate timeline-based triage. The DLL (d7a74254) carries 2077-04-21, equally falsified. The operator applied timestamp manipulation selectively across the set, which is itself a minor tradecraft signal: the two files most likely to be inspected first (the dropper and the plugin) carry real timestamps, while the components that would reveal the build date of the QuasarRAT client are backdated into the future.

Execution and Evasion: Fody Packing, Entropy Maximums, and Sandbox Hooks

Once a user executes the dropper [T1204.002], the execution chain [T1059.005] begins with the MSIL binary using Fody/Costura assembly embedding to unpack and load its embedded components. The cracked-variant dropper (21871f41) hits YARA rules INDICATOR_EXE_Packed_Fody and Costura_Protobuf — both from the ditekSHen and @bartblaze detection repositories respectively — confirming the .NET assembly uses the Fody/Costura framework to embed the QuasarRAT DLL and other dependencies as compressed resources within the binary. This technique is a common .NET RAT distribution method: rather than dropping components to disk as separate files before loading them, the dropper carries everything internally and extracts at runtime, reducing the static footprint visible to file-scanning tools.

The entropy profile of the two large droppers is consistent with this embedding approach. The primary Onimai dropper (4e90fa3f) registers a .text section entropy of 8.0 — the theoretical maximum for a uniformly random byte distribution — across a section of 8,315,904 bytes. The cracked-variant dropper (21871f41) registers .text entropy of 7.47 across 3,352,576 bytes. Both are flagged as high-entropy sections in the build provenance analysis. By contrast, the QuasarRAT client EXE (d24a538a) registers .text entropy of only 5.98 across 648,704 bytes, consistent with an unpacked MSIL assembly — it is the extracted payload, not the container. The XWorm plugin (b460ee74) registers .text entropy of 5.73 across 30,720 bytes, similarly unpacked.

The defense-evasion layer [T1497.001] is applied uniformly across all four PE payloads. The tags "detect-debug-environment" and "long-sleeps" appear on all four members of the imphash cohort. The QuasarRAT client (d24a538a) goes further: it hits YARA rules INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL (ditekSHen, detecting binaries referencing sandbox DLLs typically observed in sandbox evasion) and sandboxdetect_misc (AlienVault Labs, detecting sandbox detection tricks). The combination of environment checks and deliberate sleep delays is a standard technique to defeat time-limited sandbox analysis: the payload checks whether it is running in a virtual or instrumented environment, and if not, delays execution long enough that automated sandbox runs time out before the malicious behaviour manifests.

The primary Onimai dropper (4e90fa3f) additionally carries the tag "checks-cpu-name", suggesting it performs hardware fingerprinting before releasing its payload — a step above basic VM detection, since CPU name checks can distinguish between physical hardware and virtualised environments even when other VM artefacts have been suppressed. The XWorm plugin (b460ee74) carries the "calls-wmi" tag alongside its evasion tags, indicating WMI-based environment queries consistent with system profiling before C2 contact.

The sandbox consensus across the set is strong. The primary Onimai dropper (4e90fa3f) achieved a 5/5 malicious verdict across CAPE Sandbox, Zenbox, C2AE, VMRay, and Yomi Hunter — the only sample in the set to achieve full sandbox consensus. CAPE and VMRay both named QuasarRAT and XWorm from this single dropper, confirming it unpacks and executes both families at runtime. Zenbox classified it as MALWARE/RANSOM/TROJAN/EVADER/RAT at 75% confidence, with named families including NoCry, Quasar, TrojanRansom, and XWorm — the ransomware-adjacent labels (NoCry, TrojanRansom) are likely artefacts of Zenbox's heuristic classification rather than evidence of ransomware capability, but they indicate the dropper's behaviour is sufficiently aggressive to trigger multiple classification branches. The XWorm plugin (b460ee74) achieved a 4/4 malicious consensus, with Zenbox naming StormKitty, SugarDump, and XWorm at 100% confidence — indicating credential-harvesting and keylogging capability beyond basic RAT access.

The QuasarRAT client (d24a538a) achieved 3/4 malicious verdicts (CAPE, Zenbox, Yomi Hunter; C2AE returned undetected), with CAPE naming it as both RAT and STEALER — specifically QuasarRAT and QuasarStealer. The YARA rule MALWARE_Win_QuasarStealer (ditekSHen) fires on this sample, confirming the infostealer component is present in the client binary. The rule INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA (ditekSHen) fires on both the QuasarRAT client and the XWorm plugin, indicating both contain hardcoded non-Windows user-agent strings — likely used for HTTP-based C2 or download requests to blend with browser traffic.

Persistence and the WMI Foothold

Persistence [T1547] is established by the primary Onimai dropper (4e90fa3f), which carries both "persistence" and "calls-wmi" tags and triggered three Sigma rule matches in sandbox — one at high severity and two at medium severity from the Sigma Integrated Rule Set. The specific persistence sub-technique (registry key versus WMI subscription) is not directly evidenced and should be treated as inferred from the tag combination rather than confirmed. Zenbox's classification of the dropper as MALWARE/RANSOM/TROJAN/EVADER/RAT is consistent with a dropper that installs itself for persistence before launching its embedded RAT payloads, but the exact mechanism — whether a Run key, a scheduled task, or a WMI event subscription — cannot be determined from the available evidence alone.

The XWorm plugin (b460ee74) also carries the "calls-wmi" tag, suggesting WMI is used not only for persistence but potentially for lateral reconnaissance or system enumeration after the initial foothold is established. The "spreader" tag on the Quasar.Common.dll (d7a74254) is worth noting: it suggests the DLL component may contain functionality for propagating to additional hosts or network shares, though this tag reflects the detection engine's classification rather than confirmed sandbox behaviour, and the DLL achieved only a 0/1 malicious sandbox verdict (C2AE returned undetected) — a gap that limits confidence in the spreader characterisation.

The detection ratio across the four PE payloads ranges from 49/77 (cracked-variant dropper, 21871f41) to 62/76 (QuasarRAT client, d24a538a). The QuasarRAT client's higher detection rate reflects the maturity of QuasarRAT signatures across the industry — the family has been in circulation long enough that most major engines carry reliable detections. The lower rate on the cracked-variant dropper (49/77) likely reflects the Fody/Costura packing obscuring the inner payload from static analysis. Notably, TrendMicro and TrendMicro-HouseCall are absent from the flagging engines on both the primary dropper (4e90fa3f) and the cracked-variant (21871f41), while engines including ALYac, APEX, CrowdStrike, ESET-NOD32, Kaspersky, and Malwarebytes flag consistently across the set.

C2 Architecture: A Tunnel Service in Front of a Recycled Certificate

The command-and-control architecture [T1572] combines two layers of obfuscation that, taken together, describe an operator who understands infrastructure fingerprinting well enough to attempt countermeasures, even if the execution leaves identifiable artefacts.

The first layer is the playit.gg public tunnelling service. Both the XWorm plugin (b460ee74) and the primary Onimai dropper (4e90fa3f) independently triggered Proofpoint Emerging Threats IDS rules in sandbox: "ET INFO playit .gg Tunneling Domain in DNS Lookup" (categorised as Potentially Bad Traffic) and "ET INFO Tunneling Service in DNS Lookup (* .ply .gg)" (categorised as Misc activity). These two files share this IDS cohort as a binding axis in the campaign linkage index, confirming the operator routes C2 traffic for multiple RAT families through the same tunnelling service — a deliberate infrastructure-hiding choice rather than a per-family default. The playit.gg service is a legitimate gaming-oriented tunnel relay that allows users to expose local services through a public relay, making it attractive to low-budget operators who want to avoid registering dedicated C2 domains: the true C2 endpoint is never directly contacted by the victim host, and the tunnel relay's domain appears in DNS logs rather than the operator's infrastructure.

The second layer is the C2 endpoint itself: 158.94.208.102, sitting in AS202412 (Omegatech LTD), a RIPE NCC-registered block (158.94.208.0/22) created on 2025-09-19. The registrant organisation is listed at "HOUSE OF FRANCIS ROOM 303, ILE DU PORT, MAHE, SEYCHELLES" — a Seychelles-registered entity operating under RIPE NCC, with the IP geolocated in Germany. The AS record was last modified 2026-01-21. The IP carries a detection ratio of 19/91 and a reputation score of -13, consistent with a lightly flagged but operationally active C2 host rather than a heavily burned one.

The most analytically striking feature of this node is its TLS certificate. The last observed HTTPS certificate (serial b5c752c98781b503, last seen 2026-05-23) presents issuer CN and subject CN both set to "localhost" — a classic self-signed RAT C2 pattern that QuasarRAT and XWorm operators have used consistently across campaigns. But the certificate's validity window runs from 2009-11-10 to 2019-11-08, a ten-year span that predates the IP block's own RIPE registration by more than six years. The IP block did not exist in RIPE's registry until September 2025; the certificate purports to have been valid from 2009. This is either a recycled certificate originally generated for a different deployment and reused here, or a certificate with a deliberately backdated validity window — an operational-security anomaly that distinguishes this node from freshly provisioned infrastructure and suggests the operator may be reusing tooling or certificate material across multiple campaigns or time periods.

The combination of a Seychelles-registered entity, a Germany-geolocated VPS, a public tunnel relay obscuring direct C2 contact, and a decade-old recycled self-signed certificate presents a layered deniability stack. None of the individual components is novel — self-signed localhost certificates are a well-known QuasarRAT fingerprint, playit.gg abuse has been observed across multiple commodity RAT campaigns, and Seychelles-registered hosting providers are a common choice for operators seeking jurisdictional distance. What is notable is that all three are present simultaneously on a single C2 node, suggesting the operator has assembled a deliberate (if imperfect) counter-attribution posture rather than relying on default tool configurations.

The Pastebin URL (pastebin.com/raw/Hicz3DVN) in the IOC set may represent a dead-drop resolver or configuration-fetch mechanism — a common technique for distributing C2 configuration updates to deployed implants — but no content metadata is available for that URL, and its role in the campaign cannot be confirmed from the available evidence.

The Payload Roster: QuasarRAT, XWorm, and a Marte Dropper With Maximum Entropy

QuasarRAT is the primary implant in this deployment. The client EXE (d24a538a, 637 KB, 62/76 detections) and its companion Quasar.Common.dll (d7a74254, 72 KB, 54/76 detections) are confirmed by CAPE sandbox as RAT and STEALER — specifically QuasarRAT and QuasarStealer. Ten YARA rules fire on the client EXE, including MAL_QuasarRAT_May19_1, MALWARE_Win_QuasarStealer, quasarrat_kingrat, win_quasarrat_j2, and Vermin_Keylogger_Jan18_1. The Vermin_Keylogger rule (Florian Roth / Nextron Systems) is an interesting co-fire: it was originally authored to detect the Vermin keylogger associated with Ukrainian-nexus espionage activity, but its presence here likely reflects shared code patterns with QuasarRAT's keylogging module rather than a direct Vermin attribution. The HKTL_NET_GUID_Quasar rule (Arnim Rupp, Neo23x0 signature-base) fires on the DLL, detecting the QuasarRAT type library GUID — a static identifier embedded in the compiled assembly that persists across builds and provides a reliable family anchor.

The QuasarRAT client's internal name is "Client.exe" and its file version is 1.7.1, matching the Onimai package version string across the entire bundle. Its alt-names place it at Onimai 1.7.1/client.bin and in %TEMP% paths consistent with runtime extraction by the dropper. The JPCERT/CC asyncrat memory rule firing on both the client EXE and the DLL reflects the well-documented code-sharing between AsyncRAT and QuasarRAT — both families derive from the same open-source .NET RAT codebase lineage, and their in-memory signatures overlap sufficiently to trigger cross-family rules.

XWorm (b460ee74, 32 KB, 56/77 detections) functions as a plugin component — its meaningful name is "Plugin.exe" but it masquerades on disk as "fontdrvhost.exe", impersonating the legitimate Windows font driver host process [T1036.005]. Eight YARA rules fire on this sample, including MALWARE_Win_XWorm (ditekSHen), win_mal_XWorm (RussianPanda), rat_win_xworm_v3 (Sekoia.io, detecting XWorm version XClient v3 based on characteristic strings), and ByteCode_MSIL_Backdoor_AsyncRAT (ReversingLabs). The Sekoia.io rule specifically identifying XWorm v3 (XClient) is a useful version anchor. Zenbox's 100%-confidence verdict naming StormKitty and SugarDump alongside XWorm indicates the plugin carries credential-harvesting and keylogging modules beyond basic RAT access — StormKitty is a .NET information stealer that harvests browser credentials, Discord tokens, and system information, while SugarDump is a credential-dumping tool. The MALWARE_Win_AsyncRAT rule (ditekSHen) co-firing alongside the XWorm-specific rules reflects the same AsyncRAT code lineage noted above.

The primary Onimai dropper (4e90fa3f, 8.1 MB) is labelled trojan.msil/marte by VirusTotal's threat label classifier, with popular names including "marte" and "venomrat". The Marte/VenomRAT label reflects the dropper's outer wrapper characteristics rather than the families it deploys at runtime — CAPE and VMRay both confirm it unpacks and executes QuasarRAT and XWorm. Its 8.1 MB size is almost entirely accounted for by the .text section (8,315,904 bytes at entropy 8.0), which contains the compressed embedded payloads. The "checks-cpu-name" tag distinguishes this dropper from its cracked-variant sibling (21871f41): the primary dropper performs hardware fingerprinting before payload release, suggesting it is the more operationally mature of the two variants. Three Sigma rule matches (one high, two medium severity) fired in sandbox on this file, alongside the two playit.gg IDS rules — the Sigma matches likely correspond to WMI-based persistence and process injection behaviours observed during dynamic analysis.

The cracked-variant dropper (21871f41, 3.3 MB, 49/77 detections) is the distribution-facing copy — its primary alt-name is "Onimai Cracked by MaximsRu.exe", the filename a prospective victim would see when downloading the package. Its .text section entropy of 7.47 is lower than the primary dropper's 8.0, consistent with a slightly less aggressively packed payload body. The INDICATOR_EXE_Packed_Fody and Costura_Protobuf YARA rules fire on this variant but not on the primary dropper, suggesting the two variants use slightly different embedding approaches despite sharing the same imphash — the cracked variant uses Fody/Costura explicitly, while the primary dropper may use a different or additional packing layer that produces the higher entropy without triggering the Fody-specific rule.

The Outlier: A PowerShell File Six Months Late and Fully Undetected

The PowerShell file (bbfcb879, 0 KB, 0/77 detections, first seen 2025-10-14) is the most analytically ambiguous element in the campaign. It is named "Onimai 1.7.1/clients.json" — a JSON filename typed as PowerShell — and appears in the same %TEMP%\Onimai 1.7.1\ extraction paths as the rest of the bundle, but its first-seen date is six months after the April 2025 payload wave. It shares no imphash, signer, or threat label with any peer in the set, and carries zero AV detections across 77 engines.

The most plausible interpretation, consistent with the analyst's assessment, is that this file is a later-stage configuration updater or a separately delivered component — possibly a script that fetches updated C2 configuration, client lists, or payload URLs from an external source (the Pastebin URL in the IOC set is a candidate for this role). The "clients.json" naming is suggestive: a client list in a RAT deployment context typically refers to a list of compromised hosts or configured targets, and a PowerShell script carrying that name could serve to update the operator's client tracking or push configuration changes to deployed implants. However, with no sandbox verdict or content metadata available, this interpretation is inferred from context rather than confirmed by direct evidence, and should be treated accordingly.

The timing gap is itself operationally significant regardless of the file's specific function. The sequence — lure config staged September 2024, payload wave March–April 2025, PowerShell component October 2025 — describes a campaign with at least three distinct operational phases spread across thirteen months. This is not the profile of a one-time release; it is the profile of an operator who continues to develop, maintain, and potentially expand the deployment after the initial wave.

What the Build Pipeline Reveals About Operator Maturity

The campaign's most analytically significant feature is the operational discipline of its build pipeline. A single imphash binding four functionally distinct payloads across three RAT families — QuasarRAT, XWorm, and a Marte/VenomRAT wrapper — indicates the operator maintains a unified .NET builder rather than assembling ad-hoc tools from separate sources. This is a step above typical commodity RAT distribution, where operators typically download pre-compiled binaries from underground markets and configure them independently, producing payloads with divergent build characteristics. The consistency of imphash f34d5f2d4577ed6d9ceec516c1f5a744 across the set, combined with the uniform PEiD packer signature and the "Copyright © MrThunker 2024" string on two members, points toward a single individual or small team that compiles all variants from a shared codebase or template.

The Multifamily_RAT_Detection YARA rule (Lucas Acha) co-fires on both the QuasarRAT client and the XWorm plugin — a rule explicitly designed to detect multiple RAT families in a single scan — and its presence on two different family representatives from the same bundle is a neat encapsulation of what makes this campaign distinctive: the operator is not choosing between RAT families but deploying them in combination, presumably to maximise post-access capability. The XWorm component's Zenbox-confirmed StormKitty and SugarDump modules add credential harvesting and browser token theft to the QuasarRAT remote-access and keylogging capability, creating a post-compromise toolkit that covers the full spectrum from persistent access to data exfiltration in a single deployment.

The deliberate use of playit.gg tunnelling in front of a Seychelles-registered VPS, combined with a recycled TLS certificate whose validity window predates the IP block by years, suggests the operator is aware of infrastructure-fingerprinting techniques and is actively attempting to frustrate attribution — even if the execution is imperfect. The self-signed localhost certificate (serial b5c752c98781b503) is a well-known QuasarRAT and XWorm C2 fingerprint that has been documented across multiple campaigns; reusing a certificate with a 2009–2019 validity window does not make it less detectable, it simply adds an anomaly that complicates automated timeline-based triage. The Seychelles registrant address and Germany geolocation combination is consistent with a hosting provider that offers jurisdictional separation between the registered entity and the physical infrastructure — a common choice for operators who want to slow down abuse-report processing.

What this campaign signals, taken as a whole, is an operator at a specific maturity tier: technically capable enough to maintain a unified build pipeline, apply multi-layer evasion, and stage infrastructure months ahead of deployment, but not sophisticated enough to avoid reusing identifiable certificate material, leaving copyright strings in payload binaries, or relying on a public tunnel service that generates well-known IDS signatures. The "MrThunker 2024" copyright string and the consistent Onimai branding across the entire bundle — from the launcher config to the DLL product string to the dropper filenames — are durable hunt pivots that will remain useful as long as the operator continues to use the same build template. The thirteen-month operational span visible across this campaign, from the September 2024 lure staging to the October 2025 PowerShell component, suggests that timeline is likely to extend further.