Thursday, May 8, 2025
HomeMalwareAPT Hackers Abusing Microsoft Crypto API to Drop Backdoor on Windows Using...

APT Hackers Abusing Microsoft Crypto API to Drop Backdoor on Windows Using Weaponized Shellcode

Published on

SIEM as a Service

Follow Us on Google News

Researchers discovered a new wave of malware campaign that believed to be launched by APT hackers group using legitimate NSIS software to pack and launch the Shellcode on Windows.

NSIS (Nullsoft Scriptable Install System) is an open-source system script-driven installer authoring tool for Microsoft Windows and is used to create Windows installers.

Attackers abusing the Microsoft Crypto API to decrypt the final payload from the packer named “Loncom”, and the malware named as Trojan-Dropper.NSIS.Loncom.

- Advertisement - Google News

Loncom packer utilizes the NSIS software to run the shellcode from the file named as ” 48510113″, and the shellcode is unpacked to the hard disk and loaded into the memory.

Microsoft Crypto API
NSIS archive contents

Shellcode using an algorithm to decrypting itself step by step, once it decrypts the several such iterations of block, Shellcode starts loading libraries and retrieving the addresses of required functions with the help of the APIHashing technique.

After that, Loncom decrypts the another payload with an AES-256 block cipher that contains the same Shellcode.

Researchers analysed and observed the structure of the NSIS installers and find the final payload that located above the shellcode.

Microsoft Crypto API
NSIS data structure

Accoding to Securelist report “we noticed packed specimens of Backdoor.Win32.DarkVNC and Trojan-Ransom.Win32.Sodin families, also known as REvil and Sodinokibi. The first is a type of backdoor used for controlling an infected machine via the VNC protocol. The second is a ransomware that encrypts the victim’s information and threatens to publish it.”

Researchers also found that the campaign Cobalt Strike utility that used by the professional pentesters and some time it abused by APT hacker groups.

“The command center of the sample that contained Cobalt Strike had previously been seen distributing CactusTorch, a utility for running shellcode present in Cobalt Strike modules, and the same Cobalt Strike packed with a different packer,” Researchers said.

You can read the complete technical analysis here.

Also Read: Kinsing Malware Attacks Misconfigured Open Docker Daemon API Ports

IOC

BB00BA9726F922E07CF243D3CCFC2B6E (Backdoor.Win32.DarkVNC)
EBE191BF77044961684DF51B88CA8D05 (Backdoor.Win32.DarkVNC)
4B4C98AC8F04680F7C529956CFE8519B (Trojan-Ransom.Win32.Sodin)
AEF8FBB5C64734093E78EB13E6FA7849 (Cobalt Strike)

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Lampion Banking Malware Uses ClickFix Lures to Steal Banking Credentials

Unit 42 researchers at Palo Alto Networks, a highly targeted malicious campaign orchestrated by...

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...