# JPHP-based Windows loader (suspected d3f@ck loader) with Telegram dead-drop C2 and Defender exclusion

> A Windows loader compiled with JPHP (PHP on the JVM) bundles its own JRE, adds a Windows Defender exclusion through an elevated hidden PowerShell, and resolves its download infrastructure from Telegram dead-drop pages. It then downloads an executable that is launched through javaw.exe -jar. The family attribution to D3F@ck loader is only suspected in the primary source; related JPHP loaders (Pronsis, an AhnLab-reported downloader) share the technique set.

- **Published:** 2026-10-20T04:28:47Z
- **Last reviewed:** 2026-10-20T04:28:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3925
- **ID:** TL-2026-3925
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Tony Lambert (Forensic IT Guy, 2024-07-20) analyzed a 32-bit MinGW-built Windows executable (SHA256 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164, sourced from MalwareBazaar) that carries a ZIP overlay of roughly 19 MB. The overlay is a JPHP application package with JPHP-INF/.bootstrap as the entry point (app\modules\AppModule, include of res://.inc/jurl.phb), forms under app/forms (MainForm.phb holds the main loader logic) and modules under app/modules. JPHP compiles PHP to Java bytecode stored in .phb files. Standard Java decompilers do not read these files directly, but they contain embedded class files (Java class version 50.0) that binwalk --dd=.* can carve and CFR can decompile.

Behavior recovered from the decompiled code: (1) Defense evasion - the loader runs Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command \"Add-MpPreference -Force -ExclusionPath \"C:\\\""' -Verb RunAs}", which excludes the whole C:\ drive from Microsoft Defender scanning. (2) C2 resolution - URLs and URL fragments are Base64-encoded. A Telegram channel page is fetched and a Base64 URL is read from its og:description meta tag, which is a dead-drop resolver. A Pastebin URL is also used for domain resolution and had already been taken down at analysis time. The loader checks in periodically. (3) Payload delivery - an executable named 93.exe is downloaded from partial URLs whose domains are filled in from the dead-drop content, then auto-executed. (4) Execution - the payload is run as "<dir>\v2024\bin\javaw.exe" -jar "<dir>\Win Installer x64.exe". The v2024 folder is a bundled JRE (java.exe, javaw.exe, javacpl.exe, java.dll, awt.dll, JAWTAccessBridge.dll). Because Java reads a JAR (ZIP) from the end of the file, a single file can be both a valid PE and a valid JAR, so the executable is passed to javaw as a JAR argument.

Context from related reports: the D3F@ck loader is a malware-as-a-service loader first seen in January 2024. It was spread through Google Ads and fake application sites, used Inno Setup installers and EV certificates, and delivered Raccoon Stealer and DanaBot. LevelBlue SpiderLabs / Trustwave (2024-10-08) describes the Pronsis Loader, a separate JPHP loader that uses NSIS installers instead of Inno Setup, avoids certificates, runs Add-MpPreference -ExclusionPath $env:USERPROFILE through a randomized batch file in %Temp%, creates scheduled tasks and a mutex, and delivers Latrodectus and Lumma Stealer. AhnLab ASEC (2025-03-14) reports a JPHP downloader that bundles a JRE, disables Defender behavior monitoring, uses t.me short links, and reads a secondary C2 IP from between 'i1il' strings in Telegram channel page content. It is associated with STRRAT and DanaBot. The analyzed sample is therefore one member of a wider JPHP loader cluster, and the primary source does not state attribution, victimology or in-the-wild campaign details.

## MITRE ATT&CK

- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1204.002 User Execution: Malicious File
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1518.001 Software Discovery: Security Software Discovery
- T1082 System Information Discovery
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1102.001 Web Service: Dead Drop Resolver
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [Decompiling a JPHP Loader with binwalk and cfr (Forensic IT Guy)](https://forensicitguy.github.io/decompiling-jphp-loader-binwalk-cfr/)
- [Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader (LevelBlue SpiderLabs / Trustwave)](https://www.levelblue.com/blogs/spiderlabs-blog/pronsis-loader-a-jphp-driven-malware-diverging-from-d3fck-loader)
- [Downloader Malware Written in JPHP Interpreter (AhnLab ASEC)](https://asec.ahnlab.com/en/86859/)
- [D3Fack Loader: New Malware Exploits Google Ads and EV Certificates (Hive Pro TA2024201)](https://hivepro.com/threat-advisory/d3fack-loader-new-malware-exploits-google-ads-and-ev-certificates)
- [D3F@ck Loader, the New MaaS Loader](https://www.hendryadrian.com/?p=14342)
- [New D3F@ck Loader Exploits Google Ads, Abuses Trusted Certificates to Bypass Security](https://securityonline.info/new-d3fck-loader-exploits-google-ads-abuses-trusted-certificates-to-bypass-security/)
- [Malpedia: jar.pronsis_loader](https://malpedia.caad.fkie.fraunhofer.de/details/jar.pronsis_loader)
- [MalwareBazaar sample 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164](https://bazaar.abuse.ch/sample/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3925