Trojanized dnSpy app drops malware cocktail on researchers, devs

Hackers focused cybersecurity researchers and builders this week in a complicated malware marketing campaign distributing a malicious model of the dnSpy .NET utility to put in cryptocurrency stealers, distant entry trojans, and miners.

dnSpy is a well-liked debugger and .NET meeting editor used to debug, modify, and decompile .NET applications. Cybersecurity researchers generally use this program when analyzing .NET malware and software program.

Whereas the software program is now not actively developed by the preliminary builders, the authentic supply code and a brand new actively developed model is accessible on GitHub to be cloned and modified by anybody.

Malicious dnSpy delivers a cocktail of malware

This week, a menace actor created a GitHub repository with a compiled model of dnSpy that installs a cocktail of malware, together with clipboard hijackers to steal cryptocurrency, the Quasar distant entry trojan, a miner, and a wide range of unknown payloads.

This new marketing campaign was found by safety researchers 0day fanatic and MalwareHunterTeam who noticed the malicious dnSpy undertaking initially hosted at https://github[.]com/carbonblackz/dnSpy/ after which switching to https://github[.]com/isharpdev/dnSpy to look extra convincing.

The menace actors additionally created an internet site at dnSpy[.]web that was properly designed and professional-looking. This web site is now down, however you’ll be able to see a screenshot of the archived model beneath.

To advertise the web site, the menace actors carried out profitable search engine marketing to get dnSpy[.]web listed on the primary web page of Google. This area was additionally listed prominently on Bing, Yahoo, AOL, Yandex, and Ask.com.

As a backup plan, in addition they took out search engine adverts to look as the primary merchandise in search outcomes, as proven beneath.

The malicious dnSpy utility seems like the traditional program when executed. It means that you can open .NET purposes, debug them, and carry out all the traditional capabilities of this system.

Nevertheless, when the malicious dnSpy utility [VirusTotal] is launched, it’s going to execute a sequence of instructions that create scheduled duties that run with elevated permissions.

In a listing of the instructions shared with BleepingComputer by MalwareHunterTeam, the malware performs the next actions:

• Disables Microsoft Defender
• Makes use of bitsadmin.exe to obtain curl.exe to %windirpercentsystem32curl.exe.
• Makes use of curl.exe and bitsadmin.exe to obtain a wide range of payloads to the C:Trash folder and launch them.
• Disables Consumer Account Management.

The payloads are downloaded from http://4api[.]web/ and embrace a wide range of malware listed beneath:

• %windirpercentsystem32curl.exe – The curl program.
• C:Trashc.exe – Unknown [VirusTotal]
• C:Trashck.exe – Unknown
• C:Trashcbot.exe – Clipboard Hijacker [VirusTotal]
• C:Trashcbo.exe – Unknown [VirusTotal]
• C:Trashqs.exe – Quasar RAT [VirusTotal]
• C:Trashm.exe – Miner [VirusTotal]
• C:Trashd.exe – Respectable Defender Management utility to disable Microsoft Defender. [VirusTotal]
• C:Trashnnj.exe – Unknown

The clipboard hijacker (cbot.exe) makes use of cryptocurrency addresses utilized in earlier assaults with some success. The bitcoin tackle has stolen 68 bitcoin transactions totaling roughly $4,200.

The cryptocurrency addresses used as a part of this marketing campaign are:

Presently, each the dnSpy[.]web and the GitHub repository used to energy this marketing campaign are shut down.

Nevertheless, safety researchers and builders have to continuously be looking out for malicious clones of common initiatives that set up malware on their units.

Assaults on cybersecurity researchers and builders aren’t new and are more and more turning into extra frequent to steal undisclosed vulnerabilities, supply code, or achieve entry to delicate networks.

Final yr, Google and safety researchers found that state-sponsored North Korean hackers focused vulnerability researchers utilizing a wide range of lures. These lures included pretend Visible Studio initiatives, Web Explorer zero-day vulnerabilities, malicious cybersecurity firms, and malicious IDA Professional downloads.

IOCs:

dnSpy-net-win32.zip - 6112e0aa2a53b6091b3d7834b60da6cd2b3c7bf19904e05765518460ac513bfa
dnSpy-net-win64.zip - 005526de4599f96a4a1eba9de9d6ad930de13d5ea1a23fada26e1575f4e3cf85
curl.exe - 0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
c.exe - cabc62b3077c2df3b69788e395627921c309e112b555136e99949c5a2bbab4f2
ck.exe - NA
cbot.exe - 746a7a64ec824c63f980ed2194eb7d4e6feffc2dd6b0055ac403fac57c26f783
cbo.exe - e998df840b687ec58165355c1d60938b367edc2967df2a9d44b74ad38f75f439/
qs.exe - 70ad9112a3f0af66db30ebc1ab3278296d7dc36e8f6070317765e54210d06074
m.exe - 8b7874d328da564aca73e16ae4fea2f2c0a811ec288bd0aba3b55241242be40d
d.exe - 6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b
nnj.exe - NA