Trojanized dnSpy app drops malware cocktail on researchers, devs

guest · Jan 8, 2022

January 8, 2022

Hackers targeted cybersecurity researchers and developers this week in a sophisticated malware campaign distributing a malicious version of the dnSpy .NET application to install cryptocurrency stealers, remote access trojans, and miners.

dnSpy is a popular debugger and .NET assembly editor used to debug, modify, and decompile .NET programs. Cybersecurity researchers commonly use this program when analyzing .NET malware and software.
While the software is no longer actively developed by the initial developers, the original source code and a new actively developed version is available on GitHub to be cloned and modified by anyone.
Click to expand...

Malicious dnSpy delivers a cocktail of malware
This week, a threat actor created a GitHub repository with a compiled version of dnSpy that installs a cocktail of malware, including clipboard hijackers to steal cryptocurrency, the Quasar remote access trojan, a miner, and a variety of unknown payloads.

This new campaign was discovered by security researchers 0day enthusiast and MalwareHunterTeam who saw the malicious dnSpy project initially hosted at https://github[.]com/carbonblackz/dnSpy/ and then switching to https://github[.]com/isharpdev/dnSpy to appear more convincing.
Click to expand...

However, when the malicious dnSpy application [VirusTotal] is launched, it will execute a series of commands that create scheduled tasks that run with elevated permissions.

In a list of the commands shared with BleepingComputer by MalwareHunterTeam, the malware performs the following actions:

Disables Microsoft Defender

Uses bitsadmin.exe to download curl.exe to %windir%\system32\curl.exe.

Uses curl.exe and bitsadmin.exe to download a variety of payloads to the C:\Trash folder and launch them.

Disables User Account Control.

Click to expand...

Log in or Sign up

Trojanized dnSpy app drops malware cocktail on researchers, devs

guest Guest

Log in or Sign up

Trojanized dnSpy app drops malware cocktail on researchers, devs

guest Guest

Useful Searches