Dr.Web: two-year GitHub campaign pivots to fake security tooling, infecting 2,000+ Windows hosts with AsyncRAT, clipper and stealer
Doctor Web has detailed a GitHub supply-chain campaign that now targets information security professionals with trojanised repositories posing as scanning automation, security-testing and log-analysis tooling, after two years of luring blockchain-game, bot and cheat users. At the time of Doctor Web's research more than 2,000 PCs were infected (news.drweb.com). One decoy repository advertises a lightweight script to parse, clean and format output from the Fscan network scanner; Dr.Web's indicator list names it as Trivexqbk/FscanOutput-Beautify (github.com/DoctorWebLtd). The chain ends in an Electron-based modular loader (Microsoft.exe, Trojan.Loader.3261) that deploys the AsyncRAT backdoor, a clipboard clipper for crypto wallet addresses and an infostealer exfiltrating via a Telegram bot. No vulnerability is exploited — infection requires the victim to clone and build or run the attacker's project — but the loader's defence-evasion and antivirus-removal routines make a successful compromise deep and persistent.
Detalhes técnicos
Malicious code is hidden behind long runs of whitespace in Visual Studio project files, Python and Go sources. Dr.Web found malicious code in .suo and .csproj files as well as Python and Go source files; the .csproj carries a PreBuildEvent routine that runs the code before the project is compiled, and the .suo files contain a PowerShell command (news.drweb.com). The first-stage PowerShell script (PowerShell.Packed.270), dropped to paths such as C:\Users\Public\Pictures\t.ps1 and L.ps1, queries both attacker servers and legitimate platforms — YouTube, Telegram, Google Docs, GitCode and Pastebin — to retrieve an encrypted string that decrypts to the download link for the Quixo.7z archive, unpacked to C:\ProgramData\Windows.Microsoft.Photos (news.drweb.com).
Trojan.Loader.3261 downloads Nexara.7z with the encrypted payloads and configuration, relays system information to a Telegram bot, elevates privileges, disables Windows Defender, UAC, notifications, System Restore and VSS, adds Defender exclusions, removes McAfee, ESET and Malwarebytes, and modifies the hosts file (news.drweb.com). Its default Mode3 chains PPID spoofing on explorer.exe, a Smart App Control bypass via the VerifiedAndReputablePolicyState registry value, ntdll.dll unhooking from disk, Halo's Gate direct syscalls, an ETW patch on EtwEventWrite and an AMSI patch on AmsiScanBuffer. If successful it injects into RegAsm.exe, dwwin.exe or dwm.exe using the encrypted modules boot_f, kernel_f and thread_f, whose keys sit in Nexara/manifest/config.json; a fallback Mode2 adds regasm.exe and dwm.exe as Defender exclusions and uses PowerShell.Inject.245 to decrypt and inject into RegAsm.exe, with further Mode3non and Handler variants (news.drweb.com).
Payloads are two identical BackDoor.AsyncRAT.115 files differing only in network port — apparently so two operators can control one device at once — and Trojan.InjectNET.14, which injects Trojan.Clipper.688 into regasm.exe to swap crypto wallet addresses in the clipboard while taking screenshots sent to the Telegram bot with the clipper version, active window title, user login and device IP (news.drweb.com). JS.Stealer.191 checks for sandbox or virtual machine execution and steals browser data, FileZilla XML files, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, messenger files, gaming and game-platform account data and Discord tokens (news.drweb.com). It also deletes files and folders in system32\drivers\etc\ outside a whitelist to hinder backups (news.drweb.com). Unused routines point to a forthcoming Lodge.7z Electron project (WUDFHost.exe) that would create a service via sc.exe for Microsoft.exe persistence, re-download it if missing, control startup and handle updates (news.drweb.com).
Remediação
Treat untrusted GitHub projects as code execution: never build a cloned Visual Studio solution without inspecting .csproj PreBuildEvent entries and .suo files, and review Python/Go sources for code hidden after long whitespace padding. Hunt for PowerShell writing to C:\Users\Public\Pictures\*.ps1, archive extraction to C:\ProgramData\Windows.Microsoft.Photos, injection into RegAsm.exe, dwm.exe and dwwin.exe, new Defender exclusions, changes to VerifiedAndReputablePolicyState, and tampering with system32\drivers\etc\. Block the network indicators published by Doctor Web (github.com/DoctorWebLtd/malware-iocs). Doctor Web advises keeping antivirus databases updated and scanning all files downloaded from the internet, and states its Dr.Web products detect and remove the malware (news.drweb.com).
Linha do tempo
-
Dr.Web: two-year GitHub campaign pivots to fake security tooling, infecting 2,000+ Windows hosts with AsyncRAT, clipper and stealer
ler a análise desta fonte ocultar
Doctor Web has detailed a GitHub supply-chain campaign that now targets information security professionals with trojanised repositories posing as scanning automation, security-testing and log-analysis tooling, after two years of luring blockchain-game, bot and cheat users. At the time of Doctor Web's research more than 2,000 PCs were infected (news.drweb.com). One decoy repository advertises a lightweight script to parse, clean and format output from the Fscan network scanner; Dr.Web's indicator list names it as Trivexqbk/FscanOutput-Beautify (github.com/DoctorWebLtd). The chain ends in an Electron-based modular loader (
Microsoft.exe, Trojan.Loader.3261) that deploys the AsyncRAT backdoor, a clipboard clipper for crypto wallet addresses and an infostealer exfiltrating via a Telegram bot. No vulnerability is exploited — infection requires the victim to clone and build or run the attacker's project — but the loader's defence-evasion and antivirus-removal routines make a successful compromise deep and persistent.Technical Details
Malicious code is hidden behind long runs of whitespace in Visual Studio project files, Python and Go sources. Dr.Web found malicious code in .suo and .csproj files as well as Python and Go source files; the .csproj carries a PreBuildEvent routine that runs the code before the project is compiled, and the .suo files contain a PowerShell command (news.drweb.com). The first-stage PowerShell script (PowerShell.Packed.270), dropped to paths such as C:\Users\Public\Pictures\t.ps1 and L.ps1, queries both attacker servers and legitimate platforms — YouTube, Telegram, Google Docs, GitCode and Pastebin — to retrieve an encrypted string that decrypts to the download link for the Quixo.7z archive, unpacked to C:\ProgramData\Windows.Microsoft.Photos (news.drweb.com).
Trojan.Loader.3261 downloads Nexara.7z with the encrypted payloads and configuration, relays system information to a Telegram bot, elevates privileges, disables Windows Defender, UAC, notifications, System Restore and VSS, adds Defender exclusions, removes McAfee, ESET and Malwarebytes, and modifies the hosts file (news.drweb.com). Its default Mode3 chains PPID spoofing on
explorer.exe, a Smart App Control bypass via theVerifiedAndReputablePolicyStateregistry value,ntdll.dllunhooking from disk, Halo's Gate direct syscalls, an ETW patch onEtwEventWriteand an AMSI patch onAmsiScanBuffer. If successful it injects into RegAsm.exe, dwwin.exe or dwm.exe using the encrypted modules boot_f, kernel_f and thread_f, whose keys sit in Nexara/manifest/config.json; a fallback Mode2 adds regasm.exe and dwm.exe as Defender exclusions and uses PowerShell.Inject.245 to decrypt and inject into RegAsm.exe, with further Mode3non and Handler variants (news.drweb.com).Payloads are two identical BackDoor.AsyncRAT.115 files differing only in network port — apparently so two operators can control one device at once — and Trojan.InjectNET.14, which injects Trojan.Clipper.688 into regasm.exe to swap crypto wallet addresses in the clipboard while taking screenshots sent to the Telegram bot with the clipper version, active window title, user login and device IP (news.drweb.com). JS.Stealer.191 checks for sandbox or virtual machine execution and steals browser data, FileZilla XML files, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, messenger files, gaming and game-platform account data and Discord tokens (news.drweb.com). It also deletes files and folders in system32\drivers\etc\ outside a whitelist to hinder backups (news.drweb.com). Unused routines point to a forthcoming Lodge.7z Electron project (WUDFHost.exe) that would create a service via sc.exe for Microsoft.exe persistence, re-download it if missing, control startup and handle updates (news.drweb.com).
Remediation
Treat untrusted GitHub projects as code execution: never build a cloned Visual Studio solution without inspecting
.csprojPreBuildEvent entries and.suofiles, and review Python/Go sources for code hidden after long whitespace padding. Hunt for PowerShell writing toC:\Users\Public\Pictures\*.ps1, archive extraction toC:\ProgramData\Windows.Microsoft.Photos, injection intoRegAsm.exe,dwm.exeanddwwin.exe, new Defender exclusions, changes toVerifiedAndReputablePolicyState, and tampering withsystem32\drivers\etc\. Block the network indicators published by Doctor Web (github.com/DoctorWebLtd/malware-iocs). Doctor Web advises keeping antivirus databases updated and scanning all files downloaded from the internet, and states its Dr.Web products detect and remove the malware (news.drweb.com).