Hackers Deliver MSIX Malware in The Lure of Freemium Productivity App

Cybercriminals usually use free apps to take advantage of the large number of people who use them freely. 

The broader user base serves as a larger attack surface that ensures the effective distribution of malware. 

In addition, this could happen if third-party plugins or features have been integrated into freemium apps, which the attackers can exploit to gain unauthorized access.

Cybersecurity researchers at ASEC recently discovered that hackers have been delivering MSIC malware in the lure of freemium productivity apps.

Hackers Deliver MSIX Malware

The Malicious MSIX file masquerades as a Notion installer, and the website mimics the official page.

Notion-x86.msix’ Windows app installer signed with a valid certificate is delivered. 

Fake website (Source – ASEC)

Besides this, the install prompts seemingly legitimate Notion deployment, but the system gets malware-infected.

The signature information of the malicious installer (Source – ASEC)

The user clicks Install and gets malware-infected Notion. Installs create StartingScriptWrapper.ps1 and refresh.ps1 in the app path, ASEC said.

StartingScriptWrapper.ps1 has an MS signature that executes Powershell script from the argument and reads config.json during installation and script execution.

The refresh.ps1 is the malware that fetches and executes C2 commands.

However, it’s heavily obfuscated using blank characters integers added/multiplied to decode a 200-character command from an 8,663-character obfuscated script.

200-char command fetches and executes additional PowerShell from C2.

The initial analysis confirmed LummaC2 malware distribution. 

Logs show hxxps[:]//fleet-contents.com/1.dat downloaded, run in PowerShell.exe – likely C2 response to fetch/load 1. dat. 

1.dat is .NET EXE using process hollowing to inject LummaC2 into RegAsm.exe. While the malicious behavior process tree starts from the Windows Installer service host.

The process tree (Source – ASEC)

LummaC2 is an info stealer targeting browser data, crypto wallets, and files.

Users are advised to verify file sources match official domains and check signature authors despite legitimate certificate usage.

IoCs

Distribution Websites

  • hxxps://trynotion[.]org
  • hxxps://notion.rtpcuan138[.]com
  • hxxps://emobileo[.]com/Notion-x86.msix

File

  • d888a82701f47a2aa94dcddda392c07d (Dropper/APPX.LummaC2 2024.02.28.00) (Notion-x86.msix)
  • 3cdc99c2649d1d95fe7768ccfd4f1dd5 (Downloader/PowerShell.Obfus 2024.02.28.00) (refresh.ps1)
  • 8a3a10fcb3f67c01cd313a39ab360a80 (Trojan/Win.Generic.C5557471 2024.02.27.01) (dat1)

C2

  • hxxps://ads-tooth[.]top/check.php (refresh.ps1)
  • hxxps://fleetcontents[.]com/1.dat (check.php)
  • hxxps://problemregardybuiwo[.]fun/api (LummaC2)
  • hxxps://technologyenterdo[.]shop/api (LummaC2)
  • hxxps://lighterepisodeheighte[.]fun/api (LummaC2)
  • hxxps://detectordiscusser[.]shop/api (LummaC2)
  • hxxps://edurestunningcrackyow[.]fun/api (LummaC2)
  • hxxps://pooreveningfuseor[.]pw/api (LummaC2)
  • hxxps://turkeyunlikelyofw[.]shop/api (LummaC2)
  • hxxps://associationokeo[.]shop/api (LummaC2)

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

200,000 WordPress Sites Exposed to Cyber Attack, Following Plugin Vulnerability

A critical security vulnerability has been discovered in the popular WordPress plugin Anti-Spam by CleanTalk, which…

5 hours ago

Beware Of SpyLoan Apps Exploits Social Engineering To Steal User Data

SpyLoan apps, a type of PUP, are rapidly increasing, exploiting social engineering to deceive users…

7 hours ago

Researchers Detailed Tools Used By Hacktivists Fueling Ransomware Attacks

CyberVolk, a politically motivated hacktivist group, has leveraged readily available ransomware builders like AzzaSec, Diamond,…

7 hours ago

Blue Yonder Ransomware Attack Impacts Starbucks & Multiple Supermarkets

A ransomware attack on Blue Yonder, a leading supply chain management software provider, has created…

9 hours ago

Dell Wyse Management Suite Vulnerabilities Let Attackers Exploit Affected Systems Remotely

Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address…

9 hours ago

CISA Details Red Team Assessment Including TTPs & Network Defense

The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment…

9 hours ago