Subj : This new malware hijacks Windows WordPad to avoid detection
To   : All
From : TechnologyDaily
Date : Mon May 29 2023 11:30:03

This new malware hijacks Windows WordPad to avoid detection

Date:
Mon, 29 May 2023 10:22:20 +0000

Description:
Qbot operators are at it again, using legitimate software to distribute 
malware via Windows WordPad.

FULL STORY
======================================================================

Hackers have begun abusing a flaw in the WordPad text editor that comes 
preloaded with the Windows 10 operating system to distribute the Qbot malware 
, researchers have claimed. 

A cybersecurity researcher and a member of Cryptolaemus, going by the alias 
ProxyLife discovered a new email campaign in which hackers are distributing 
the WordPad program together with a malicious .DLL. 

When WordPad is launched, it will look for certain .DLL files it needs in 
order to properly run. First, it will look for the files in the same folder 
it resides, and if it finds them - it will automatically run them, even if 
those .DLL files are malicious. DLL hijacking 

The practice is usually called DLL sideloading or DLL hijacking and its a 
known method. Previously, hackers were seen using the Calculator app to do 
the same thing. 

In this particular instance, when WordPad runs the DLL, the malicious file 
will use an executable called Curl.exe (found in the System32 folder) to 
download a DLL pretending to be a PNG. That DLL is actually Qbot, an ancient 
banking trojan that can steal emails to use in more phishing attacks, and 
initiate the download of additional malware, such as Cobalt Strike, for 
example. Read more 

> Qbot malware found smuggled inside Windows Installer packages 


 > This powerful email malware attack uses PDF and WSF files to break your 
defenses 


 > These are the best firewalls around 

By using legitimate programs, such as WordPad, or Calculator, to run the 
malicious DLL files, threat actors are hoping to bypass any antivirus 
programs and remain stealthy during the attack. 

However, as this method requires Curl.exe to be used, it only works on 
Windows 10 and newer versions, as previous versions did not have this program 
preinstalled. That doesnt do much good as older versions are mostly reaching 
end of support anyway, and users are moving towards Windows 10 and Windows 
11. 

Right now, BleepingComputer reports, the QBot operation has moved on to other 
infection methods in recent weeks. Here's our list of the best endpoint 
protection software around 

Via: BleepingComputer



======================================================================
Link to news story:
https://www.techradar.com/news/this-new-malware-hijacks-windows-wordpad-to-avo
id-detection


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.