MALFEX npm campaign moves its loader into imgdecode, a native Windows addon that injects shellcode into dllhost.exe

Linha do tempo

1. safedep.io ↗ · pub. 12/10/2026 21:00 · coletado 19/10 18:03 primeiro registro

   MALFEX npm campaign moves its loader into imgdecode, a native Windows addon that injects shellcode into dllhost.exe

   ler a análise desta fonte ocultar

   SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive console, the addon tries to download an AES-256-CBC encrypted payload from GitHub, decrypts it and injects the shellcode into a suspended dllhost.exe. No install script is needed, so controls that only block install scripts do not stop it. The package was still on npm on 2026-10-13. A related payload chain leads to the MALFEX stealer and RAT, but SafeDep could not recover banner.jpg, so the native loader's link to that payload is an inference.

   Technical Details

   • Trigger and condition: the N-API init function napi_register_module_v1 runs the loader from version 1.0.1. It runs only if GetConsoleMode succeeds on stdout, so CI jobs and sandboxes with redirected output are skipped. Versions 1.0.1 and 1.0.2 still require imgbundle; 1.0.3 is standalone.
   • Obfuscation: strings are XOR-encoded with key 0x37. The URL is hxxps://raw.githubusercontent[.]com/cavecrew/proj/main/banner.jpg, fetched through WinINet with user agent Mozilla/5.0.
   • Decryption: the AES-256 key is the SHA-256 of nif-runtime-2027, in CBC mode with the first 16 bytes of the response as IV. If the plaintext starts with a JPEG or PNG signature, the loader stops, which is a possible kill switch.
   • Injection: the loader starts dllhost.exe suspended and hidden, then uses VirtualAllocEx, WriteProcessMemory, VirtualProtectEx and CreateRemoteThread. The fallback runs the bytes inside node.exe. The payload must be raw shellcode.
   • Linkage to MALFEX: the GitHub repo and stage-2 downloader match Checkmarx's report. The recovered stage-2 (SHA-256 2f268ca7…) is a Go downloader that fetches hxxp://104.234.65[.]75:700/setup.exe and saves it as svc_update.exe. That server (AS265919, BB Host LTDA, São Paulo) still served a 71.5 MB pkg-packed Node.js 18 stealer/RAT named movinlike on 2026-10-13.
   • Stealer/RAT capabilities (inferred from string tables, not confirmed by execution): VM and analysis-tool checks; Chromium passwords and cookies, including Chrome app-bound key recovery; Discord token theft and discord_desktop_core patching; crypto wallet, game and Telegram data; collection of seed, key and .env files; a WebSocket RAT on port 7007 (shell, file transfer, screenshots, clipboard, input); persistence via %APPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe, a Run key and the scheduled task MicrosoftEdgeUpdateService; and Security/Sysmon EVTX tampering.
   • Replacement chain: npm removed native-runner and img-to-native on 2026-09-28. The operator then published runhelper (koffi FFI) and imgdecode, with 1.0.3 published on 2026-10-11. npm reported 929 imgdecode downloads from 2026-09-30 to 2026-10-12, and the number of affected hosts is unknown.
   • Hunting signals: a prebuilds/ DLL in a package with no native source or binding.gyp; an addon importing WinINet/WinHTTP and bcrypt without image codec code; node.exe as parent of dllhost.exe without a /Processid: argument; node.exe contacting raw.githubusercontent.com followed by dllhost.exe contacting an unknown host. SafeDep published a YARA rule for the three DLL builds.

   Remediation

   • Treat any Windows workstation that loaded imgdecode, imgbundle, runhelper or another MALFEX package as potentially compromised.
   • Isolate the host and capture memory before reboot, since the shellcode runs in memory.
   • Check for the persistence entries above and for node.exe spawning dllhost.exe.
   • Rotate browser passwords, session cookies, Discord tokens, cloud keys, SSH keys and npm/GitHub tokens, and move funds from wallets whose seed phrases were on the host.
   • Compare local Security and Sysmon logs with external log sources, since the stealer can tamper with local logs.