Threat reportMalwareTL-2026-5242

Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction

mediumMONITORING

Aryaka Threat Research Lab (Aditya K Sood, Bikash Dash, 2026-11-02) traced a multi-stage Windows infection chain that starts with a PowerShell loader associated with get.activated.win (deceptive Microsoft Activation Scripts activity), retrieves contis.exe from srv.conti.pk over HTTPS with PE validation, and reconstructs a ~4.19 MiB non-PE buffer in memory using layered cryptography.

Key facts for contis.exe loader chain

Identifiers	TL-2026-5242
Severity	MEDIUM
First disclosed	2026-11-02
Exploitation status	No known exploitation
Affected products	Microsoft Windows
Tools	Microsoft Activation Scripts (MAS), Themida
MITRE ATT&CK techniques	T1027 Obfuscated Files or Information, T1027.002 Software Packing, T1036 Masquerading, T1059.001 PowerShell, T1140 Deobfuscate/Decode Files or Information, T1497.001 System Checks, T1543.003 Windows Service, T1620 Reflective Code Loading, T1622 Debugger Evasion
Motivation	UNKNOWN
Detection rules	9 (1 shown free)
Sources	7 cited sources

Detection coverage for contis.exe loader chain

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5242 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PowerShell Loader Retrieving External Executable (contis.exe / srv.conti.pk) - Exploitation Phase

Detects Stage 1 of the TL-2026-5242 chain: powershell.exe or pwsh.exe whose command line references the named payload host srv.conti.pk or payload contis.exe, or combines a download cmdlet/method (irm, iwr, Invoke-WebRequest, DownloadFile, Start-BitsTransfer) with a .exe target, or pipes content from the get.activated.win (MAS look-alike) domain into iex. Based on Aryaka's guidance to monitor PowerShell retrieving external executables from unusual infrastructure (T1059.001, T1105). get.activated.win is also the legitimate MAS domain, so that branch is a lower-fidelity hunting signal.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1059.001, T1105
Data sources: sysmon, windows_security_4688_commandline, microsoft_defender_for_endpoint
Severity: high
Confidence: medium

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*powershell.exe" OR Image="*pwsh.exe") | eval dl=if(match(CommandLine,"(?i)(invoke-restmethod|invoke-webrequest|downloadfile|downloadstring|start-bitstransfer|[ (;](irm|iwr)[ ])"),1,0) | eval ioc=if(match(CommandLine,"(?i)(srv[.]conti[.]pk|contis[.]exe)"),1,0) | eval exe=if(match(CommandLine,"(?i)[.]exe"),1,0) | eval mas=if(match(CommandLine,"(?i)activated[.]win.*[|][ ]*(iex|invoke-expression)"),1,0) | where ioc=1 OR (dl=1 AND exe=1) OR mas=1 | eval reason=case(ioc=1,"TL-2026-5242 IOC srv.conti.pk/contis.exe",dl=1 AND exe=1,"PowerShell download of executable",mas=1,"irm|iex from get.activated.win (validate URL)") | stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as CommandLine values(ParentImage) as ParentImage values(reason) as reason by host User Image | convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe', 'pwsh.exe')
| where ProcessCommandLine has_any ('srv.conti.pk', 'contis.exe')
    or (ProcessCommandLine has_any ('irm', 'iwr', 'Invoke-RestMethod', 'Invoke-WebRequest', 'DownloadFile', 'DownloadString', 'Start-BitsTransfer') and ProcessCommandLine contains '.exe')
    or (ProcessCommandLine has 'activated.win' and ProcessCommandLine has_any ('iex', 'Invoke-Expression'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: PowerShell Loader Retrieving External Executable - TL-2026-5242
id: 5c1e7a52-3b8d-4f0a-9d71-2a6c0e4b8f11
status: experimental
description: Detects PowerShell command lines referencing srv.conti.pk or contis.exe, downloading an executable, or piping get.activated.win content into iex (multi-stage loader chain reported by Aryaka 2026-11-02).
references:
    - https://www.aryaka.com/blog/powershell-loader-multi-stage-windows-malware-analysis/
    - https://www.aryaka.com/reports-and-guides/peeling-back-the-layers-of-powershell-loader/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ioc:
        CommandLine|contains:
            - 'srv.conti.pk'
            - 'contis.exe'
    selection_dl:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadFile'
            - 'DownloadString'
            - 'Start-BitsTransfer'
            - ' irm '
            - ' iwr '
    selection_exe:
        CommandLine|contains: '.exe'
    selection_mas:
        CommandLine|contains|all:
            - 'activated.win'
            - 'iex'
    condition: selection_img and (selection_ioc or (selection_dl and selection_exe) or selection_mas)
falsepositives:
    - Administrators legitimately running the public Microsoft Activation Scripts one-liner (irm https://get.activated.win | iex)
    - Software deployment scripts that download signed installers with Invoke-WebRequest
level: high

Known false positives:

Legitimate use of the public MAS one-liner from get.activated.win by IT staff (the domain is the real MAS project domain, not proof of compromise)
Software deployment or patching scripts that download installers with Invoke-WebRequest or Start-BitsTransfer

Tuning notes: Treat the srv.conti.pk / contis.exe branch as high fidelity and the get.activated.win branch as hunting-grade; validate the exact loader URL before blocking. Allow-list known deployment hosts and signed installer URLs by parent process or account. Adjust the index name to your Sysmon index.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

[indicator] Payload Execution or File Drop ([indicator]/UPX2-Packed Native Payload) · unlock with TL Creds
PowerShell Script Block Showing Layered Crypto Reconstruction (HKDF/RC4/ChaCha20-Poly1305/AES-GCM/AES-CBC) · unlock with TL Creds
Large Executable Private Memory Allocation / Protection Transition (~4.19 MiB Non-PE Buffer) · unlock with TL Creds
PowerShell Anti-Debug and Hypervisor/Environment Checks in Script Block · unlock with TL Creds
PowerShell Delayed Self-Cleanup of Staged Files (Start-Sleep + Remove-Item in User-Writable Paths) · unlock with TL Creds
PowerShell-Spawned Randomly Named Executable From User-Writable Path · unlock with TL Creds
DNS/Network Contact with Payload Host [indicator] or PowerShell Contact with [indicator] - C2/Delivery · unlock with TL Creds
New LocalSystem Windows Service Launching from User-Writable Path - Persistence · unlock with TL Creds

Indicators of compromise for contis.exe loader chain

As of 2026-11-04, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5242.

Sample indicators (2 of 7)

Domain: srv[.]conti[.]pk
Domain: get[.]activated[.]win

Defanged, TLP:CLEAR. Full set of 7 indicators: unlock with TL Creds.

7 indicators of compromise · unlock with TL Creds. Compare plans

How contis.exe loader chain works

No malware family name, actor, or CVE is stated in the readable source material.

Aryaka Threat Research Lab published 'Peeling Back the Layers of PowerShell Loader: Tracing a Multi-Stage Windows Payload Chain' on 2026-11-02. The full PDF exceeds the 10 MB fetch limit, so this record is built from the Aryaka blog summary, the Aryaka report landing page, the malware.news post and the Malpedia library entry only; details that appear only in the PDF (hashes, full URLs, detailed MITRE mapping, malware family) were not read and are not asserted.

Sourced infection chain: (1) a PowerShell loader associated with get.activated.win, with the report landing page describing privilege escalation, deceptive Microsoft Activation Scripts (MAS) activity, randomized file execution and delayed cleanup; (2) a native payload, contis.exe, retrieved from srv.conti.pk over HTTPS with PE validation; (3) a final runtime stage reconstructed in memory. The reconstructed buffer is approximately 4.19 MiB, has no valid PE structure, and is moved into dynamically allocated memory and prepared for execution from private memory not backed by a conventional PE image, using VirtualAlloc, VirtualProtect and CreateThread with memory-protection transitions. The landing page also states persistence via a Windows service running under the LocalSystem account.

The reconstruction applies HKDF key derivation and multiple transformations: RC4, ChaCha20-Poly1305, AES-256-GCM and AES-256-CBC. The payload performs environment-aware anti-analysis checks covering debugger state, PEB debugging state, hardware-debugging state, system resources, hypervisor presence and other host characteristics. Static analysis shows an unusually large virtual BSS region, a .text section with zero raw size, and unusual section names including 'themida' and 'UPX2'.

Caution on attribution of indicators: get.activated.win is publicly documented as the legitimate domain of the open-source Microsoft Activation Scripts (MAS) project (usage: irm https://get.activated.win | iex), and public MAS guidance warns that malware is spread via look-alike URLs. Aryaka only says the loader is 'associated with' this domain / MAS-related; it is not confirmed whether the domain itself serves malicious content or is the lure/context. Do not block it blindly without validating against the report's loader URL. srv.conti.pk and contis.exe are the payload host and filename per Aryaka. The name resemblance to the 'Conti' ransomware brand is not evidence of a link and none is asserted.

The landing page lists ATT&CK techniques as 'inferred' (T1134 privilege escalation, T1543.003 Windows service persistence, process hollowing/module stomping); the mapping here uses only those with direct textual support and treats the rest as unconfirmed.

Severity MEDIUM and status MONITORING are analyst placeholders. Exploitability, actor, motivation and victimology are not stated in the readable sources. Aryaka's separate DonutLoader report ('Beyond the Batch File') is by the same team but the link to this report is not confirmed.

Detection guidance from the source: monitor for PowerShell retrieving external executables from unusual infrastructure, connections to the identified domains, large private memory allocations followed by executable-memory transitions, environment/debugger checks by newly launched processes, and correlate behavior across stages instead of relying on isolated indicators.

MITRE ATT&CK techniques by tactic:

Remediation for contis.exe loader chain

Immediate actions

Hunt for PowerShell processes that download and execute external executables, and for contis.exe on endpoints
Alert on DNS/proxy resolutions of srv.conti.pk; validate any get.activated.win traffic against the specific loader URL before blocking since the domain is also the legitimate MAS domain
Alert on PE files with 'themida' or 'UPX2' section names and zero-raw-size .text sections
Review newly installed Windows services running as LocalSystem that launch from user-writable paths

Workarounds

Restrict PowerShell with Constrained Language Mode / application control where feasible
Block users from running 'irm <url> | iex' pipelines from the internet via policy and egress filtering

Longer-term hardening

Enable PowerShell Script Block and Module logging and AMSI-integrated EDR
Detect VirtualAlloc/VirtualProtect transitions leading to execution from non-image-backed memory
Correlate behavior across loader stages rather than single indicators

Affected and fixed versions

Microsoft — Windows
Vulnerable versions: Not specified in source

Timeline of contis.exe loader chain

2026-11-02 Report landing page describes persistence through a Windows service running as LocalSystem (activity dates not stated).
2026-11-02 Report documents Stage 3: ~4.19 MiB non-PE buffer reconstructed in memory via HKDF, RC4, ChaCha20-Poly1305, AES-256-GCM and AES-256-CBC and executed from private memory using VirtualAlloc/VirtualProtect/CreateThread (activity dates not stated).
2026-11-02 Report documents Stage 2: native payload locked-ioc-4 retrieved over HTTPS from locked-ioc-3 with PE validation, protected with locked-ioc-5/UPX2-named sections (activity dates not stated).
2026-11-02 Report documents Stage 1: a PowerShell loader associated with locked-ioc-2, with deceptive MAS activity, privilege escalation, randomized file execution and delayed cleanup (activity dates not stated in readable sources).
2026-11-02 malware.news reposts the report announcement, listing locked-ioc-2, locked-ioc-3 and locked-ioc-4 as the named indicators.
2026-11-02 Malpedia library records the report (no abstract) with the Aryaka PDF link; the date is the publication date, not an observed-activity date.
2026-11-02 Aryaka Threat Research Lab (Aditya K Sood, Bikash Dash) publishes 'Peeling Back the Layers of PowerShell Loader' report and blog summary.

Sources cited for contis.exe loader chain

Peeling Back the Layers of PowerShell Loader: Tracing a Multi-Stage Windows Payload Chain (Aryaka report PDF) aryaka.com · Research · 2026-11-02
Peeling Back the Layers of PowerShell Loader (Aryaka report landing page) aryaka.com · Research · 2026-11-02
Malpedia library entry malpedia.caad.fkie.fraunhofer.de · Research · 2026-11-02
Aryaka Threat Research Lab aryaka.com · Vendor report · 2026-11-02
Aryaka DonutLoader multi-stage loader report (related, link to this chain unconfirmed) aryaka.com · Research · 2026-11-02
PowerShell Loader Malware Analysis: Multi-Stage Windows Payload Execution (Aryaka blog) aryaka.com · Blog · 2026-11-02
Malware News: Peeling Back the Layers of PowerShell Loader malware.news · News · 2026-11-02

Drafted by the Threadlinqs research pipeline from 7 sources; published 2026-11-04; last updated —.

Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction

Key facts for contis.exe loader chain

Detection coverage for contis.exe loader chain

Free detection: PowerShell Loader Retrieving External Executable (contis.exe / srv.conti.pk) - Exploitation Phase

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for contis.exe loader chain

Sample indicators (2 of 7)

How contis.exe loader chain works

Defense Evasion

Execution

Discovery

Persistence

Privilege Escalation

Remediation for contis.exe loader chain

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of contis.exe loader chain

Sources cited for contis.exe loader chain

Latest Threats

🔄 Threat Comparison

Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction

Key facts for contis.exe loader chain

Detection coverage for contis.exe loader chain

Free detection: PowerShell Loader Retrieving External Executable (contis.exe / srv.conti.pk) - Exploitation Phase

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for contis.exe loader chain

Sample indicators (2 of 7)

How contis.exe loader chain works

Defense Evasion

Execution

Discovery

Persistence

Privilege Escalation

Remediation for contis.exe loader chain

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of contis.exe loader chain

Sources cited for contis.exe loader chain

More in malware

Latest Threats

🔄 Threat Comparison