Tuesday, March 18, 2025
Homecyber securityHackers Use DLL Side-Loading to Deploy Malicious Python Code

Hackers Use DLL Side-Loading to Deploy Malicious Python Code

Published on

SIEM as a Service

Follow Us on Google News

A recent discovery by Xavier Mertens, a senior handler at the Internet Storm Center, has highlighted a sophisticated attack where hackers utilize DLL side-loading to deploy malicious Python code.

This technique involves tricking an application into loading a malicious DLL instead of a legitimate one, allowing attackers to execute malicious code while evading detection by security tools.

The Attack Vector

The attack begins with a ZIP archive named “Hootsuite (1).zip,” which contains a file named Hootsuite.exe disguised as a PDF reader.

 Python Code
behavior of the PDF reader

This executable is a copy of the old Haihaisoft PDF reader, known to have a DLL side-loading vulnerability. When executed from a normal directory, it functions as expected.

However, when run from the directory extracted from the ZIP archive, it loads a malicious msimg32.dll instead of the legitimate Microsoft version.

This malicious DLL is significantly larger than the official one, likely to avoid detection by security tools due to performance considerations.

Upon execution, the PDF reader’s behavior changes dramatically, as confirmed through debugging.

The attack involves unpacking and installing a Python environment, fetching a Python bot, and executing it using a renamed “synaptics.exe” to bypass security rules that monitor for suspicious process names.

Persistence is achieved by adding a registry entry that runs a batch script at startup, ensuring the malware remains active even after the system restarts.

Evasion Techniques and Persistence

The attackers employed several evasion techniques, including renaming the Python executable to “synaptics.exe” to avoid detection by simple security rules.

Additionally, they used a Base64-encoded string to implement persistence, which involves creating a batch script that runs at startup.

According to the Report, this script is encoded and decoded using certutil, a legitimate Windows tool, to further evade detection.

The use of a decoy PDF file, which is not malicious, serves as a distraction, opening in the default system viewer to maintain the illusion of legitimacy.

This incident underscores the growing sophistication of attacks leveraging DLL sideloading, a technique that exploits Windows’ DLL loading behavior to execute malicious code within the context of legitimate applications.

It highlights the need for robust security measures to protect against such threats, particularly in environments where Python and other scripting languages are used extensively.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

Aman Mishra
Aman Mishra
Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Latest articles

MirrorGuard: Adaptive Defense Mechanism Against Jailbreak Attacks for Secure Deployments

A novel defense strategy, MirrorGuard, has been proposed to enhance the security of large...

New ClearFake Variant Uses Fake reCAPTCHA to Deploy Malicious PowerShell Code

A recent variant of the ClearFake malware framework has been identified, leveraging fake reCAPTCHA...

New BitM Attack Enables Hackers to Hijack User Sessions in Seconds

A recent threat intelligence report highlights the emergence of a sophisticated cyberattack technique known...

Hackers Exploit Hard Disk Image Files to Deploy VenomRAT

In a recent cybersecurity threat, hackers have been using virtual hard disk image files...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

MirrorGuard: Adaptive Defense Mechanism Against Jailbreak Attacks for Secure Deployments

A novel defense strategy, MirrorGuard, has been proposed to enhance the security of large...

New ClearFake Variant Uses Fake reCAPTCHA to Deploy Malicious PowerShell Code

A recent variant of the ClearFake malware framework has been identified, leveraging fake reCAPTCHA...

New BitM Attack Enables Hackers to Hijack User Sessions in Seconds

A recent threat intelligence report highlights the emergence of a sophisticated cyberattack technique known...