MALFEX npm campaign shifts to imgdecode native Windows DLL loader that injects shellcode into dllhost.exe

Linha do tempo

1. safedep.io ↗ · pub. 12/10/2026 21:00 · coletado 02/11 05:00 primeiro registro

   MALFEX npm campaign shifts to imgdecode native Windows DLL loader that injects shellcode into dllhost.exe

   ler a análise desta fonte ocultar

   SafeDep found that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign and hides its loader in a prebuilt Windows Node.js native addon. When require('imgdecode') runs from an interactive Windows console, the DLL downloads AES-256-CBC encrypted shellcode from GitHub (cavecrew/proj) and injects it into a suspended dllhost.exe. No install script is needed, so install-script blocking does not stop it. The package was still on npm on 2026-10-13; version 1.0.3 was published 2026-10-11, six days after the Checkmarx report. A related chain leads to a 71.5 MB MALFEX stealer and RAT, but the link from the native loader to that payload is an inference because banner.jpg was not recovered.

   Technical Details

   • Trigger: index.js loads prebuilds/win32-x64/imgdecode.node. The loader runs in the N-API init function napi_register_module_v1.
   • Gating: it runs only if GetConsoleMode succeeds on stdout, which skips CI and sandboxes with redirected output.
   • Obfuscation: strings are XOR-encoded with 0x37; APIs are resolved via GetProcAddress.
   • Download and decrypt: WinINet fetches banner.jpg with user agent Mozilla/5.0. The key is SHA-256 of nif-runtime-2027, the IV is the first 16 bytes, and decryption uses CNG. If the plaintext starts with a JPEG or PNG signature, the loader stops.
   • Injection: CreateProcessW starts dllhost.exe suspended, then VirtualAllocEx, WriteProcessMemory, VirtualProtectEx and CreateRemoteThread run the shellcode. The fallback runs it inside node.exe.
   • Recovered chain: the Internet Archive copy of banner.png decrypts to a 6.17 MB Go downloader (SHA-256 2f268ca7…, listed by Checkmarx) that fetches http://104.234.65[.]75:700/setup.exe (saved as svc_update.exe). That file is a 71.5 MB pkg-packed Node.js 18 app named movinlike (SHA-256 8d50cb1b…), with C2 at 104.234.65.75:7007 and license key MALFEX-89BEE69BB61967AF1C3B07C9. The IP is in AS265919 (BB Host LTDA), São Paulo.
   • Inferred stealer capabilities: anti-analysis checks, Chromium passwords and cookies, Discord token theft and client patching, wallet and game data, file harvesting, a WebSocket RAT, persistence as MicrosoftEdgeUpdate.exe with a Run key and the scheduled task MicrosoftEdgeUpdateService, and Security/Sysmon EVTX tampering.
   • Exposure: npm showed 929 downloads from 2026-09-30 to 2026-10-12, and no public dependents were found.
   • Hunting signals: a prebuilds DLL with no native source or binding.gyp; an addon importing WinINet and bcrypt with no image codec code; node.exe as parent of dllhost.exe without a /Processid: argument; node.exe connecting to raw.githubusercontent.com, then dllhost.exe connecting to an unknown host. SafeDep published a YARA rule.

   Remediation

   • Treat any Windows workstation that loaded imgdecode, imgbundle, runhelper or another MALFEX package as compromised.
   • Isolate it and collect memory before reboot, since the shellcode runs in memory.
   • Check for the persistence entries and for node.exe spawning dllhost.exe.
   • Rotate browser passwords, session cookies, Discord tokens, cloud, SSH, npm and GitHub credentials, and move crypto funds if seed phrases were present.
   • Compare local event logs with external logs because of the log-tampering capability.