New Backdoor, MadMxShell

This report analyzes a multi-stage backdoor (MadMxShell) delivered via a trojanized Advanced-ip-scanner executable that sideloads a large IVIEWERS.dll to inject and run a compressed/encrypted payload; the chain drops a OneDrive.exe and Secur32.dll pair which are used to persist and launch stage shellcode that disables Defender, performs process hollowing, and provides a remote backdoor. The backdoor generates session and victim IDs, supports file operations and remote command execution via cmd.exe, and exfiltrates/receives commands through encoded DNS MX queries to litterbolo.com using a custom 36-character encoding and packetization scheme.