Hackers Hijacked Notepad++ Plugin To Inject Malicious Code

Hackers gain manipulated a favored Notepad++ plugin, injecting malicious code that compromises customers’ methods upon execution.

The AhnLab Security Intelligence Heart (ASEC) researchers gain published that the “mimeTools.dll” plugin, which is widely venerable, turn into modified to plot the attack.

Notepad++, a textual grunt and source code editor appreciated by programmers and writers for its versatility and plugin again, grew to become an unwitting car for cybercriminals.

Malicious vs Authentic Kit

The altered “mimeTools.dll” plugin, a default ingredient of Notepad++, turn into chanced on to be masquerading as a true bundle, deceiving customers into downloading and installing the compromised model.

The mimeTools plugin, identified for its encoding functionalities akin to Base64, is robotically loaded when Notepad++ is launched. Attackers exploited this behavior the exercise of a system identified as DLL Hijacking.

When Notepad++.exe is launched, the “mimeTools.dll” file is robotically loaded, triggering the activation of the embedded malicious code, without from now on consumer bolt.

The attackers ingeniously added encrypted malicious Shell Code and the code to decrypt and plot it right thru the “mimeTools.dll” file.

ASEC’s investigation highlighted a file named “certificate.pem” right thru the altered bundle as the container of the malicious shell code.

Despite the manipulation, the plugin’s usual functionalities remained intact, with finest the DllEntryPoint code being altered. This stealthy advance ensures that the malicious activities commence the 2nd the DLL is loaded, unbeknownst to the patron.

The execution drift of the malicious code begins with the launching of Notepad++ and the next loading of the “mimeTools.dll.”

The DLL then decrypts and executes the Shell Code contained in the “certificate.pem” file, initiating the attack.

As cybercriminals proceed to conform their tactics, the cybersecurity neighborhood remains committed to uncovering and mitigating such threats, safeguarding customers’ digital experiences.

IoC

File analysis
– Trojan/Regain.WikiLoader.C5594131
– Trojan/Regain.WikiLoader.R642896
– Trojan/Bin.ShellCode

[MD5]
– c4ac3b4ce7aa4ca1234d2d3787323de2 : bundle file(npp.8.6.3.portable.x64.zip)
– 6136ce65b22f59b9f8e564863820720b : mimeTools.dll
– fe4237ab7847f3c235406b9ac90ca8 forty five: certificate.pem
– d29f25c4b162f6a19d4c6b96a540648c: bundle file(npp.8.6.4.portable.x64.zip )
– 8b7a358005eff6c44d66e44f5b266d33 : mimeTools.dll
– d5ea5ad8678f362bac86875cad47ba21 : certificate.pem

[C&C]
– hxxps://car***************.com/wp-grunt/subject matters/twentytwentytwo/nnzknr.php?identity=1
– hxxps://pro** ********.catch/wp-grunt/subject matters/twentytwentythree/hyhnv3.php?identity=1
– hxxps://www.technology********.ecu/wp-grunt/subject matters /twentytwentyfour/dqyzqp.php?identity=1
– hxxps://www.mar**********.it/wp-grunt/subject matters/twentytwentyfour/c2hitq.php?identity=1
– hxxps:/ /osa*******.com/wp-grunt/subject matters/twentytwentythree/ovqugo.php?identity=1
– hxxps ://www.ala************.com/ wp-grunt/subject matters/twentytwentyfour/34uo7s.php?identity=1
– hxxps://13*******.org/wp-grunt/subject matters/twentytwentythree/t51kkf.php?identity=1
– hxxps:/ /alt**************.com/wp-grunt/subject matters/twentytwentyfour/c9wfar.php?identity=1
– hxxps://www.am*******. com/wp-grunt/subject matters/twentyten/b9un4f.php?identity=1
– hxxps://lu*******************.com/wp-grunt/subject matters /twentytwentytwo/pam8oa.php?identity=1
– hxxps://www.yu*******.de/wp-grunt/subject matters/twentytwentytwo/n2gd2t.php?identity=1

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide