Saturday, April 13, 2024

New Malicious PyPI Packages Use DLL Sideloading In A Supply Chain Attack

Researchers have discovered that threat actors have been using open-source platforms and codes for several purposes, such as hosting C2 infrastructure, storing stolen data, and delivering second and third-stage downloaders or rootkit programs.

Two open-source PyPI packages were discovered to be utilized by threat actors for executing code via DLL sideloading attacks as a means of evading security monitoring tools.

The packages were identified as NP6HelperHttptest and NP6HelperHttper. 

Malicious PyPI Packages

According to the reports shared with Cyber Security News, open-source ecosystems are most widely used by almost every developer, which does not have a reputation provider to assess the quality and reliability of the code.

Thus making it extremely simple and easier for threat actors to insert malicious codes into the repositories and perform supply chain attacks.

In addition to this, researchers discovered two attack types that are used in software supply chain attacks, namely typosquatting and repojacking.

The two malicious PyPI packages were involved in the Typosquatting attacks as the package names are identical to one of the legitimate NP6 packages.

Malware infection stages (Source: Reversing Labs)

Developers mostly ignore the spelling and consider the packages legitimate, proceeding to use them in development.

Once this is done, threat actors can pivot their ways into the organizations and perform malicious activities.

Malicious Script Abusing DLL Sideloading

Both of the malicious PyPI packages consisted of a setup.py script that extends the setup tools command for downloading two other files: Comserver.exe and dgdeskband64.dll.

Comserver.exe is a legitimate file signed with a valid certificate from Beijing-based Kingsoft Corp, while dgdeskband64.dll is a malicious file that downloads further and runs a second-stage payload.

Setup.py file (Source: Reversing Labs)

The Comserver.exe has the purpose of loading a library, dgdeskband64.dll, for invoking its exported function Dllinstall.

However, the dgdeskband64.dll malicious file inside the package is not the legitimate one expected from comserver.exe. 

Different exports for the legit and malicious dll (Source: Reversing Labs)

This custom-built dgdeskband64.dll by threat actors does the same Dllinstall export function under the disguise of the legitimate Dgdeskband64.dll library, resulting in a DLL sideloading attack.

This is done as a means of avoiding detection of the malicious code. 

Moreover, execution of the malicious code is achieved by registering an exception handler inside the Dllinstall export function.

A second sample was also found, but it does not exploit DriverGenius’ ComServer.exe; instead, it uses a .exe and target DLL, windowsaccessbridge-64.dll. 

However, the functionality of both the samples is similar, and the same URL downloads the same payload as the other PyPI packages.

Indicators Of Compromise

PyPI Packages

package_nameversionSHA1
NP6HelperHttptest0.11fc236e94b54d3ddc4b2afb8d44a19abd7cf0dd4
NP6HelperHttptest0.2dfc8afe5cb7377380908064551c9555719fd28e3
NP6HelperHttptest0.373ece3d738777e791035e9c0c94bf4931baf3e3a
NP6HelperHttptest0.4e3a7098e3352fdbb5ff5991e9e10dcf3b43b1b86
NP6HelperHttptest0.5575bcc28998ad388c2ad2c2ebc74ba583f5c0065
NP6HelperHttptest0.6a1bb4531ce800515afa1357b633c73c27fa305cf
NP6HelperHttper0.1a65bce340366f724d444978dcdcd877fa2cacb1c

Additional Indicators:

descriptionURI
Domain that’s hosting the malicious dllhttps://fus.rngupdatem[.]buzz
Domain that’s hosting the shellcode payloadUs.archive-ubuntu.top
nametypeSHA1
dgdeskband.dllPE/dll1f9fcf86a56394a7267d85ba76c1256d12e3e76b
windowsaccessbridge-64.dllPE/dll84c75536b279a85a5320f058514b884a016bc8c8
an.gifshellcode2dc80f45540d0a3ea33830848fcf529f98ea2f5e

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.

Website

Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles