The subtle hacking group often called StrongPity is circulating laced Notepad++ installers that infect targets with malware.

This hacking group, also called APT-C-41 and Promethium, was beforehand seen distributing trojanized WinRAR installers in highly-targeted campaigns between 2016 and 2018, so this method will not be new.

The current lure entails Notepad++, a very fashionable free textual content and supply code editor for Home windows utilized in a variety of organizations.

The invention of the tampered installer comes from a risk analyst often called ‘blackorbird’ analysts, whereas Minerva Labs reviews on the malware.

#APT #StrongPity NotePad++ installer(npp.8.1.7.Installer.x64.exe)
78556a2fc01c40f64f11c76ef26ec3ff
http[:]//advancedtoenableplatform.com pic.twitter.com/eEXZWIObnH

— blackorbird (@blackorbird) November 30, 2021

Upon executing the Notepad++ installer, the file creates a folder named “Home windows Information” underneath C:ProgramDataMicrosoft, and drops the next three recordsdata:

• npp.8.1.7.Installer.x64.exe – the unique Notepad++ set up file underneath C:UsersUsernameAppDataLocalTemp folder. 
• winpickr.exe – a malicious file underneath C:WindowsSystem32 folder. 
• ntuis32.exe – malicious keylogger underneath C:ProgramDataMicrosoftWindowsData folder

The set up of the code editor continues as anticipated, and the sufferer will not see something out of the extraordinary that would increase suspicions.

Because the setup finishes, a brand new service named “PickerSrv” is created, establishing the malware’s persistence by way of startup execution.

This service executes ‘ntuis32.exe’, which is the keylogger element of the malware, and runs it in a minimized window.

The keylogger data all consumer keystrokes and saves them to hidden system recordsdata dumped created within the ‘C:ProgramDataMicrosoftWindowsData’ folder. The malware additionally has the power to steal recordsdata and different information from the system.

This folder is constantly checked by ‘winpickr.exe,’ and when a brand new log file is detected, the element establishes a C2 connection to add the stolen information to attackers.

As soon as the switch has been accomplished, the unique log is deleted to wipe the traces of malicious exercise.

Keep secure

If it’s good to use Notepad++, ensure that to supply an installer from the mission’s web site. 

The software program is offered on quite a few different web sites, a few of which declare to be the official Notepad++ portals however might embody adware or different undesirable software program.

The URL that was distributing the laced installer has been taken down following its identification by analysts, however the actors might rapidly register a brand new one.

Comply with the identical precautions with all software program instruments you are utilizing, irrespective of how area of interest they’re, as refined actors are significantly all in favour of specialised software program circumstances that are perfect for watering gap assaults.

On this case, the probabilities of detection from an AV software on the system can be roughly 50%, so utilizing up-to-date safety instruments is crucial too.