Software Firm from India Has Products Breached for Spreading Data-Stealing Malware
Trojanized versions of the installers for three different software products created by a software company based in India, known as Conceptworld, have been used to distribute data-stealing malware.
These installers pertain to Notezilla, RecentX, and Copywhiz, as identified by cybersecurity company Rapid7, which detected the compromise in the supply chain on June 18, 2024. Conceptworld resolved the issue on June 24, just 12 hours after being informed.
“The trojanized installers were programmed to run data-stealing malware capable of downloading and executing additional payloads,” the firm mentioned in their communication, highlighting that the illicit versions had a larger file size compared to the authentic ones.
The malware, in particular, is designed to pilfer browser credentials and cryptocurrency wallet data, record clipboard content and keystrokes, as well as fetch and execute extra payloads on compromised Windows systems. Moreover, it establishes persistence through a timed task to execute the core payload every three hours.
It remains unclear how the genuine domain “conceptworld[.]com” got breached to push out the forged installers. Following installation, the user is prompted to proceed with the actual software’s installation process, and at the same time, it initiates the drop and execution of a file titled “dllCrt32.exe” tasked with running a batch script named “dllCrt.bat.”
Other than setting up persistence on the device, it’s programmed to trigger another program (“dllBus32.exe”) that establishes connections with a command-and-control (C2) server and integrates functions for data theft and executing further payloads.
This includes harvesting details and other data from Google Chrome, Mozilla Firefox, and various cryptocurrency wallets (like Atomic, Coinomi, Electrum, Exodus, and Guarda). It can also snatch files with specific extensions (.txt, .doc, .png, and .jpg), log keystrokes, and capture clipboard data.
“The fake installers noted in this scenario lack a digital signature and possess an abnormal file size compared to the legitimate installer copies,” as stated by Rapid7.
Users who downloaded any of the installers for Notezilla, RecentX, or Copywhiz in June 2024 are encouraged to investigate their systems for signs of unauthorized access and implement suitable measures – like reinstalling the affected systems – to reverse the illicit alterations.
About Author
