GCVE-110-OSM-2026-13628

This package is a supply-chain dropper disguised as a click-counting helper. The DLL implements a complete botnet registration lifecycle against `api.3dodo.com` (AddBird, AddBirdDetails, AddBirdGeo, AddWindowsVersion, RemoveBird — a 'Birds' metaphor for infected hosts), beacons to `conversionbeauty.com/tweet/alive` for keepalive, exfiltrates OS information via `conversionbeauty.com/api/os/ss`, and downloads a secondary executable from `https://3dodo.com//vanilla//miniplover.exe` using `URLDownloadToFileW`. Registry persistence is implemented via `RegCreateKeyW`/`RegSetValueExW`, memory injection via `VirtualProtect`, and `IsDebuggerPresent` (repeated 4+ times) actively detects analysis environments. The geo-lookup against `api.country.is` is consistent with victim profiling before payload delivery. No legitimate click-counting library ships with this combination of C2 registration, executable download, registry persistence, anti-debugging, and memory injection capabilities. OBFUSCATION - Binary: Executable Packer in lib/net472/miniClickerLib.dll: "compress2" ADDITIONAL FINDINGS - Binary: Injection in lib/net472/miniClickerLib.dll: "VirtualProtect" - Binary: Process in lib/net472/miniClickerLib.dll: "ShellExecuteW" - Binary: Network in lib/net472/miniClickerLib.dll: "URLDownloadToFileW" - Binary: Persistence in lib/net472/miniClickerLib.dll: "RegCreateKeyW" - Binary: Anti Analysis in lib/net472/miniClickerLib.dll: "IsDebuggerPresent" - Binary: Network IOCs Detected in lib/net472/miniClickerLib.dll: "https://api.country.is" PAYLOAD FILES lib/net472/miniClickerLib.dll