New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

[silversurfer]

Content source

https://thehackernews.com/2023/03/new-dotrunpex-malware-delivers-multiple.html

A new piece of malware dubbed dotRunpeX is being used to distribute numerous known malware families such as Agent Tesla, Ave Maria, BitRAT, FormBook, LokiBot, NetWire, Raccoon Stealer, RedLine Stealer, Remcos, Rhadamanthys, and Vidar.

"DotRunpeX is a new injector written in .NET using the Process Hollowing technique and used to infect systems with a variety of known malware families," Check Point said in a report published last week.

Said to be in active development, dotRunpeX arrives as a second-stage malware in the infection chain, often deployed via a downloader (aka loader) that's transmitted through phishing emails as malicious attachments.

Alternatively, it's known to leverage malicious Google Ads on search result pages to direct unsuspecting users searching for popular software such as AnyDesk and LastPass to copycat sites hosting trojanized installers.

New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

dotRunpeX is a new malware injector that's distributing various known malware families via phishing emails & malicious Google Ads.

thehackernews.com

Highlights:​

• Check Point Research (CPR) provides an in-depth analysis of the dotRunpeX injector and its relation to the older version
• DotRunpeX is protected by virtualization (a customized version of KoiVM) and obfuscation (ConfuserEx) – both were defeated
• Investigation shows that dotRunpeX is used in the wild to deliver numerous known malware families
• Commonly distributed via phishing emails as malicious attachments and websites masquerading as regular program utilities
• We confirmed and detailed the malicious use of a vulnerable process explorer driver to disable the functionality of Anti-Malware services
• CPR introduces several PoC techniques that were approved to be effective for reverse engineering protected or virtualized dotnet code

DotRunpeX - demystifying new virtualized .NET injector used in the wild - Check Point Research

ImplMap2x64dbgInvoke-DotRunpeXextract

research.checkpoint.com