Rapid7 investigated trojanized installers for Notezilla, RecentX, and Copywhiz distributed via Conceptworld, uncovering information-stealing malware that can download and execute additional payloads. The malware persists via a scheduled task and exfiltrates data while covertly running in the background. #Notezilla #dllFake
Keypoints
- Rapid7 found trojanized Notezilla, RecentX, and Copywhiz installers hosted on Conceptworld’s site, delivering information-stealing malware and extra payloads.
- The compromised installers were unsigned and mismatched in file size, indicating tampering with legitimate packages.
- Malware family dllFake collects browser credentials, cryptoWallet data, logs clipboard contents and keystrokes, and can download and execute additional payloads.
- Initial access occurred via a supply-chain compromise of Conceptworld’s distribution channel using conceptworld[.]com.
- Attack chain involves unpacking the installer, dropping staging files in AppData/Temp, and creating a hidden scheduled task to run the main payload every three hours.
- Malware uses batch scripts and Windows API calls (ShellExecuteA) to atomically stage and launch the legitimate installer while executing malicious components in the background.
- Defensive guidance includes verifying file integrity, signatures, and re-imaging affected systems; detections cover persistence via SchTasks and SFTP-based exfiltration.
MITRE Techniques
- [T1584.004] Compromise Infrastructure – The threat actor gained access to the official domain responsible for serving software downloads. “The threat actor gained access to the official domain responsible for serving software downloads.”
- [T1195.002] Supply Chain Compromise: Compromise Software Supply Chain – The threat actor trojanized copies of the legitimate installers being served on the official website, to execute malware. “trojanized copies of the legitimate installers being served on the official website, to execute malware.”
- [T1204.002] User Execution: Malicious File – Users are tricked into executing the malicious installer as it is served from the official website. “Users are tricked into executing the malicious installer as it is served from the official website.”
- [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Much of the malware’s functionality is facilitated through batch script files. “Much of the malware’s functionality is facilitated through batch script files.”
- [T1059.006] Command and Scripting Interpreter: Python – Several second stage payloads were created using PyInstaller. “Several second stage payloads were created using PyInstaller.”
- [T1053.005] Scheduled Task/Job: Scheduled Task – Initial execution of the primary batch script is delayed by at least 3 hours by the creation of a scheduled task. “Initial execution of the primary batch script is delayed by at least 3 hours by the creation of a scheduled task.”
- [T1053.005] Scheduled Task/Job: Scheduled Task – The malware is executed every 3 hours and will persist through reboots. “The malware is executed every 3 hours and will persist through reboots.”
- [T1555.003] Credentials from Web Browsers: Credentials from Web Browsers – The malware decrypts and dumps credentials from Google Chrome and Mozilla Firefox. “The malware decrypts and dumps credentials from Google Chrome and Mozilla Firefox.”
- [T1560.001] Archive Collected Data: Archive via Utility – Stolen data is archived via 7z.exe. “Stolen data is archived via 7z.exe.”
- [T1115] Clipboard Data – A second stage malware payload dumps all clipboard data to disk. “Clipboard data”
- [T1005] Data from Local System – The malware compresses and steals files according to a file extension list and directory path strings blacklist. “compresses and steals files according to a file extension list and directory path strings blacklist.”
- [T1056.001] Input Capture: Keylogging – A second stage malware payload logs keystrokes to disk. “logs keystrokes to disk.”
- [T1571] Non-Standard Port – The threat actor uses port 2265 for SFTP instead of the default: 22. “uses port 2265 for SFTP instead of the default: 22.”
- [T1048] Exfiltration Over Alternative Protocol – The malware uploads stolen data to C2 servers using SFTP via curl. “uploads stolen data to C2 servers using SFTP via curl.”
Indicators of Compromise
- [Domain/URL] conceptworld[.]com – The official domain that was serving malicious installers.
- [Domain/URL] conceptworld[.]com; [IPv4] 5.180.185[.]42 – C2 IP address hosting an SFTP server.
- [Network] 212.70.149[.]210 – C2 IPv4 address hosting an SFTP server.
- [Network] 50.2.108[.]102 – C2 IPv4 address hosting an SFTP server.
- [Host-Based] NotezillaSetup.exe – Trojanized installer package. 6F49756749D175058F15D5F3C80C8A7D46E80EC3E5EB9FB31F4346ABDB72A0E7
- [Host-Based] NotezillaSetup32.exe – Trojanized installer package. BFA99C41AECC814DE5B9EB8397A27E516C8B0A4E31EDD9ED1304DA6C996B4AAA