I got hit by a fake Cloudflare popup and reverse engineered the malware it dropped. Here’s what I found.

A few weeks ago I was browsing and got one of those "Verify you are human" Cloudflare popups. Except it wasn't Cloudflare — it was a ClickFix page that told me to press Win+R and paste a command. I'm on Linux so nothing executed on me, but I grabbed the file and spent time tearing it apart. Here's what's inside.

The file: Tourmaline.exe (~10.8 MB)

It's not a typical dropper. It's an Inno Setup 6.7.0 installer (Revision 2, 64-bit offsets — which broke every standard extraction tool I tried including innoextract) that bundles a full Python 3.11 runtime and two stages of obfuscated payload.

Stage 1 — Anti-sandbox time-lock

The first stage is a ~13 line obfuscated Python script with a clever trick: it counts down from 99,999,999 to find an XOR decryption key via brute force. On a sandbox with a 60-second timeout it never finishes. On a real machine it runs in seconds. I cracked it instantly using a known-plaintext attack on the first 4 bytes of the encrypted blob — recovered the key in O(1) without running the loop at all.

Stage 2 — Full Python RAT

Once decrypted, it's a hand-rolled Python backdoor with no external dependencies. Here's what it does:

• DNS tunneling — all C2 traffic goes out as raw UDP DNS queries directly to 158.94.211.185:53, disguised as *.microsoft.com lookups. Fully custom DNS packet builder, no library used.
• Blockchain dead-drop — on startup it calls an Ethereum Sepolia smart contract (0x2d7a04cca0c34005f58393f30ac725e25f19e5f5) to get the current C2 IP, decrypted locally with a hardcoded ChaCha20 key. I verified this live — the contract returned the active IP. The attacker can update it any time, making IP blocklists useless.
• ECDSA-signed commands — tasks from the C2 are P-256 signature verified before execution. You can't sinkhole it by intercepting the DNS tunnel.
• Arbitrary Python exec — whatever the C2 sends back gets exec()'d in a persistent namespace. Full remote code execution.
• Persistence as TourmalineUpdate in Task Scheduler, disguised as "Hardware monitoring service."

Everything is in my GitHub repo — deobfuscated source, YARA rules, IOCs (JSON + CSV), and a decryption tool that reproduces the key recovery: https://github.com/v-pun215/Tourmaline

Sample is included as a password-protected zip (infected) following the standard for sharing malware samples safely.

Happy to answer questions on the methodology, especially the custom Inno Setup Revision 2 format parsing and the known-plaintext bypass.