DragonsGate Loader: The Evolving Download Mechanism Behind TamperedChef / EvilAI

Research update | November 11, 2026

During ongoing investigation into the TamperedChef / EvilAI ecosystem, we have continued to encounter suspicious application installers distributed through gated advertising campaigns. These campaigns can deliver apparently functional PDF, recipe, and other utility applications while using a separate installer-stage mechanism to contact remote infrastructure and potentially retrieve additional content.

We are tracking this evolving downloader mechanism under the research name DragonsGate Loader. This is our name for the installer-side delivery and gating behavior—not a claim that every application bearing these traits is a separate malware family or that the final payload has been recovered.

Distribution: The Ad Click Still Matters

Our observations continue to suggest that the advertising referral path is important. An installer obtained after following a particular sponsored or redirected download path may differ from one obtained by visiting the apparent software website directly. Direct visits may instead result in a benign download, such as WinRAR.exe, or another non-equivalent installer. This makes collection and reproduction more difficult: the original advertisement, referral context, and server-side checks may determine what is served.

What DragonsGate Does

DragonsGate appears to serve as the downloader and execution gate for these TamperedChef / EvilAI-associated application installers. A semi-legitimate, functional-looking application can still be installed. In the variants analyzed so far, the suspicious behavior we have identified is concentrated in the setup and installation phase, rather than in demonstrated malicious behavior by the installed application's ordinary GUI.

That distinction is important: an application successfully launching does not establish that its installer was benign. Likewise, our inability to obtain an additional payload does not establish that the downloader is harmless. At present, we have not observed the final suspected malicious payload being delivered during our controlled tests.

Multiple Installer Implementations

Across related samples, we have encountered several installer and loader implementations, including NSIS, Inno Setup, Go, and .NET. The implementation varies, but the broader pattern of installer-stage network checks and conditional progression remains an important investigative lead. It is possible that this variation reflects experimentation with delivery techniques or detection evasion; we cannot yet determine the operator's motivation.

Anti-Analysis and Server-Side Gating

Recent .NET variants have introduced particularly noticeable anti-analysis behavior. We observed process enumeration before the normal application interface appeared, with checks for tools used by malware analysts, including Frida, Fiddler, dnSpy/ILSpy, and debuggers. In some runs, the installer exited early after detecting analysis tooling; in other runs, it proceeded to the otherwise ordinary application GUI.

Some installer variants also behave poorly when their traffic is intercepted through Fiddler. This complicates analysis, but a failed run under a proxy is not, by itself, proof that the sample deliberately detected the proxy.

In controlled response-replay experiments, we identified an initial validation condition involving a 32-byte hash-like server response with an even-parity requirement. Satisfying that condition allowed the tested downloader to progress to its update GUI. However, advancing to that interface did not cause a confirmed malicious payload to be delivered. Additional, presently unidentified gating appears to remain, potentially on the server side.

What We Know—and What We Do Not

FindingCurrent assessment
Ad/referral-dependent deliveryObserved; direct-download results may differ.
Functional-looking application installationObserved, even when installer behavior raises concerns.
NSIS, Inno Setup, Go, and .NET implementationsObserved across investigated variants.
Pre-GUI anti-analysis and early exitObserved in newer variants.
32-byte even-parity response conditionPartially reproduced in a tested variant; advanced to update GUI.
Delivery of the final suspected malicious payloadNot observed in controlled analysis to date.
Other server-side eligibility checksSuspected; exact conditions remain unknown.
Rapid changes responding to public write-upsPlausible hypothesis, not confirmed attribution of intent.

Why the Name “DragonsGate”?

The name is a reference to Dragon's Den, one of the malware-analysis lab environments used during our research. These installers repeatedly stopped, exited, or failed to advance at different stages in that environment. Investigating those gates required multiple techniques, including static .NET analysis, process inspection, API instrumentation, network interception, and controlled server-response testing. “DragonsGate” captures that repeated pattern of having to work through one gate only to encounter another.

Are the Operators Reacting to Research?

We have seen rapid implementation changes, particularly around the .NET variants and their anti-analysis checks. Given recent public analysis of related installers, it is possible these changes are intended to evade analyst workflows or published detections. The timing alone, however, does not prove that connection. Different builders, delivery tests, or ordinary operator iteration could also explain the changes.

Technical Write-Ups and Detection Resources

This post is intentionally a high-level summary. Detailed findings, experiments, and analysis artifacts are available in the following GitHub locations:

Closing Thoughts

At this stage, the most consequential feature of DragonsGate is not a recovered payload, but the combination of advertising-based distribution, conditional installer execution, anti-analysis checks, and response-dependent download progression. These traits make it easy to mistake an incomplete infection for a harmless install.

Our investigation remains focused on determining what additional conditions unlock delivery, and on distinguishing behavior confirmed in the lab from what the downloader appears designed to do. Until those conditions are understood, the final payload and full post-installation impact remain unconfirmed.

Comments

Post a Comment

Popular posts from this blog

Beware of Fake 7zip Installer: upStage Proxy

Image
Deep dive into the UpStage Proxy malware campaign abusing a fake 7-Zip installer to deploy a GO-based residential proxy backdoor on Windows systems. Over the past couple weeks analysts have been looking at a suspicious 7zip installer which turns the host into a residential proxy (proxyware). I'm playfully calling this upStage Proxy (with a heroquest boardgame theme). More on the name will become clear in this article. The installer comes from 7zip[.]com, which, while looking professional, and having been around for quite some time, is in fact not the official site for the 7zip tool. The official site is 7-zip.org . *Update February 10, 2026: At this time the download link is now pointing to the official 7-zip.org download. The installer is signed by (now revoked) certificate:  "JOZEAL NETWORK TECHNOLOGY CO., LIMITED". The installer drops a version of 7zfm.exe that is also signed with this signer.  This version of 7zfm.exe differs from the official build in an importan...
Read more

Microsoft Store Apps May Deliver Go Backconnect Proxy Malware

Image
Analysis of fake utility installers delivering proxyware malware through Microsoft App Store. With findings related to Ghostsocks. Quick Summary A consolidated analysis of suspicious Microsoft Store utility apps, including WinDirStat and LightShot impersonators, that load a shared Go-based client.dll backconnect/proxy implant. Primary payload: client.dll Primary C2: mylabubus.shop Compiler: Go 1.24.9 Assessment: Backconnect / proxy malware Contents Executive Summary Key Findings Technical Analysis Evidence Summary Campaign Correlation Indicators of Compromise MITRE ATT&CK Mapping Responsible Disclosure Updates Executive Summary I analyzed a suspicious Microsoft Store utility package, focusing in particular on a WinDirStat impersonator. The analysis combined manual reverse engineering and runtime testing with AI-assisted workflows using REMnux MCP, Malcat MCP with Claude, and automated sandbox analysis. The application presented itself as a normal El...
Read more

New HydraSeven malware loader found in the wild

Image
Analysis of customloader pdfconverters.exe,pdfunk.exe: HydraSeven Malware, .NET malware loader impersonating PDF software. Updated Nov 22, 2023 Updated notes are at the bottom of the page. Hello World! I am investigating a new malware loader and calling this unknown loader Hydra Seven . Here are some of the details. Over the past several weeks there has been some limited chatter about an interesting suspicious PDF software (pdfconverters.exe, pdfunk.exe). The first details I've run across with this were found on this twitter post https://twitter.com/neonprimetime/status/1711510658959749324 . The initial analysis suggests the malware may be related to redline through some heuristic detections from a couple security vendors. This is possible, though I haven't been able to verify Redline yet, I'm still working on it. I started digging a bit into the pdfconverters.exe, which leads to a download and install of AppData\Local\Temp\PDFunk-Setup.exe then ultiamtely AppDa...
Read more