AhnLab Security Intelligence Center uncovered a malicious LNK file disguised as a credit card security email pop-up aimed at stealing user information through DLL downloads and execution. The attack uses PowerShell scripts, reflective DLL injection, and decoy HTML files to avoid detection and steal data from multiple browsers and services. #AhnLab #ReflectiveDLLInjection #notepadlog
Keypoints
- A malicious LNK file named “card_detail_20250610.html.lnk” impersonates a credit card company’s security email authentication pop-up.
- The attack downloads an HTA file and a bait HTML document alongside the LNK file to deceive users.
- A malicious DLL file (sys.dll) and a text file (user.txt) containing URLs for further DLL downloads are created and executed on the victim’s system.
- Three additional DLL files (app, net, and notepad.log) are downloaded and loaded via reflective DLL injection, complicating detection.
- The ‘app’ and ‘net’ DLLs function as infostealers targeting multiple browsers and online services, while ‘notepad.log’ acts as a backdoor with remote command execution and keylogging.
- Keylogging data is stored locally in the C:Users{username}AppDataLocalnetkey directory, indicating active data exfiltration.
- The use of legitimate decoy HTML files and sophisticated execution techniques highlights the increasing complexity of such social engineering threats.
MITRE Techniques
- [T1176] Browser Extensions – ‘app’ DLL steals information from Chrome, Brave, and Edge browsers.
- [T1059.001] PowerShell – Previously used for keylogging and data exfiltration methods.
- [T1218] Signed Binary Proxy Execution – Execution of malicious DLL via rundll32.exe (‘The malicious DLL is executed via rundll32.exe, manifesting the malicious behavior’).
- [T1055] Process Injection – ‘app’ file is injected into the running chrome.exe process to steal data stealthily.
- [T1560] Archive Collected Data – ‘notepad.log’ collects and exfiltrates files (‘Collects file list, Exfiltrates file, Downloads file’).
- [T1115] Clipboard Data – Keylogging data is collected and saved locally (‘notepad.log saves the keylogging data in the C:Users{username}AppDataLocalnetkey directory’).
Indicators of Compromise
- [File Name] Malicious LNK file – card_detail_20250610.html.lnk
- [File Hashes (MD5)] Malicious files – 046aab6c2bcd4f87b70edd14330f326b, 71105e164f5838049aa9b1c634ab6047, and others.
- [URLs] Malicious DLL download locations – https://cdn.glitch.global/b33b49c5-5e3d-4a33-b66b-c719b917fa62/app64.log, https://cdn.glitch.global/b33b49c5-5e3d-4a33-b66b-c719b917fa62/net64.log.
- [FQDN] Command and control domain – pkkfbv.webhop.me
Read more: https://asec.ahnlab.com/en/89156/