Proxyware Malware Masquerades as Notepad++ to Hijack Systems via Windows Explorer

A sophisticated proxyjacking campaign targeting systems in South Korea, with threat actor Larva-25012 deploying Proxyware disguised as legitimate Notepad++ installers.

The attacker employs advanced evasion techniques, including process injection into Windows Explorer and Python-based loaders, marking a significant evolution in Proxyjacking attack methodologies.

Proxyjacking is a monetization scheme in which attackers secretly install Proxyware on victim machines without their consent, hijacking the system’s network bandwidth to generate revenue.

Unlike legitimate Proxyware which compensates users for voluntarily sharing bandwidth the malicious variant funnels all profits directly to threat actors.

This attack class parallels Cryptojacking but exploits network resources rather than computational power for mining cryptocurrency.

Larva-25012 has been addressed at 2024, distributing multiple Proxyware variants including DigitalPulse, Honeygain, and Infatica.

The group traditionally distributed malware through deceptive advertisements on websites offering free YouTube video downloads and fake software cracking portals.

Recent campaigns shift this strategy, leveraging compromised GitHub repositories to host malicious installers that masquerade as popular utilities such as AutoClicker, FastCleanPlus, and WinMemoryCleaner.

The initial payload, DPLoader downloader malware, establishes persistence via Windows Task Scheduler and retrieves commands from command-and-control (C&C) servers.

While PowerShell scripts have historically installed Proxyware, the attacker maintains the flexibility to deploy alternative malware types.

Technical Attack Chain: MSI and ZIP Variants

The MSI variant represents a departure from previous .NET-based implementations, now utilizing C++ DLL delivery. Upon execution, the malware registers as “Notepad Update Scheduler” in Task Scheduler, launching via Rundll32.exe.

The DLL injects shellcode into the AggregatorHost.exe process, deploying a PowerShell dropper that generates JavaScript-based DPLoader instances.

To evade detection, the script modifies Windows Defender policies by adding exclusion paths and turning off security notifications.

The ZIP variant employs DLL side-loading through a malicious TextShaping.dll bundled alongside a legitimate Notepad++ Setup.exe.

Upon user execution, encrypted shellcode decrypts an embedded dropper, installing Python and deploying a Python-based DPLoader variant.

This launcher registers in Task Scheduler as “Notepad Update Scheduler,” achieving persistence through GUID-named VBS executables.

DPLoader exists in two variants: JavaScript and Python implementations. Both communicate with C&C infrastructure by transmitting system metadata including OS type, hostname, architecture, and machine ID.

The JavaScript variant supports command execution, while the Python version uses distinct endpoints for operations (/d) and error reporting (/e).

This DLL functions as an injector, targeting explorer.exe and injecting an obfuscated Go-based DigitalPulse payload. Upon injection, the malware collects system information and activates bandwidth-sharing functionality.

Similarly, Infatica deployment creates “Microsoft Anti-Malware Tool” scheduled tasks, masquerading as legitimate Windows security components while loading Infatica agent modules.

Mitigations

The most notable technical advancement involves Windows Explorer process injection. When deploying DigitalPulse Proxyware, DPLoader creates a scheduled task executing syncupdates.dll via Rundll32.exe.

Users should download software exclusively from official vendor sources, avoiding suspicious websites, advertisements, and file-sharing platforms.

Organizations should monitor for scheduled task anomalies, particularly entries referencing “Notepad Update Scheduler,” “UNBScheduler,” “UNPScheduler,” and “MicrosoftWindowsPlutonTaskScheduler.”

Security solutions should detect explorer.exe injection patterns and Python installer deployments in user AppData directories.

Compromised systems require immediate deployment of endpoint detection and response (EDR) solutions and comprehensive security audits to identify additional Proxyware installations exploiting network resources.

IOCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.