This new malware hijacks Windows WordPad to avoid detection
Qbot operators are at it again, this time with Windows WordPad
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers have begun abusing a flaw in the WordPad text editor that comes preloaded with theWindows 10operating systemto distribute the Qbotmalware, researchers have claimed.
A cybersecurity researcher and a member of Cryptolaemus, going by the alias ProxyLife discovered a new email campaign in which hackers are distributing the WordPad program together with a malicious .DLL.
When WordPad is launched, it will look for certain .DLL files it needs in order to properly run. First, it will look for the files in the same folder it resides, and if it finds them - it will automatically run them, even if those .DLL files are malicious.
DLL hijacking
The practice is usually called “DLL sideloading” or “DLL hijacking” and it’s a known method. Previously, hackers were seen using the Calculator app to do the same thing.
In this particular instance, when WordPad runs the DLL, the malicious file will use an executable called Curl.exe (found in the System32 folder) to download a DLL pretending to be a PNG. That DLL is actually Qbot, an ancient banking trojan that can steal emails to use in more phishing attacks, and initiate the download of additional malware, such as Cobalt Strike, for example.
Qbot malware found smuggled inside Windows Installer packages>This powerful email malware attack uses PDF and WSF files to break your defenses>These are the best firewalls around
By using legitimate programs, such as WordPad, or Calculator, to run the malicious DLL files, threat actors are hoping to bypass any antivirus programs and remain stealthy during the attack.
However, as this method requires Curl.exe to be used, it only works on Windows 10 and newer versions, as previous versions did not have this program preinstalled. That doesn’t do much good as older versions are mostly reaching end of support anyway, and users are moving towards Windows 10 andWindows 11.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Right now, BleepingComputer reports, the QBot operation has moved on to other infection methods in recent weeks.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
The 6 best electric motorcycle concepts and launches from EICMA 2024
