NUMOZYLOD Malware Exploits MSIX Installers for Dangerous Code Execution

Recent malware campaigns have seen a rise in trojanized MSIX installers targeting users seeking business software. These attacks, orchestrated by the threat actor “eugenfest,” leverage a PowerShell script named NUMOZYLOD to download additional malware payloads. 

NUMOZYLOD is part of a MaaS operation distributing various malware, including ICEDID, REDLINESTEALER, CARBANAK, LUMMASTEALER, and ARECHCLIENT2, underscoring the growing trend of threat actors collaborating in the underground economy to acquire specialized tools and services. 

The exploitation of MSIX as a covert method for bundling and distributing malware alongside legitimate software is also brought to light under this investigation.

UNC4536 uses malvertising to distribute trojanized MSIX installers of popular software, which contain malicious payloads, such as NUMOZYLOD, that are executed using the Package Support Framework (PSF) during the installation process. 

The attackers leverage the PSF’s ability to run scripts before or after the main application starts by adding configuration items called startScript and endScript, respectively, which allows them to stealthily deploy malicious payloads onto victims’ systems.

The analyzed trojanized MSIX files revealed a sophisticated attack technique, as the package structure, including the AppxManifest.xml, config.json, StartingScriptWrapper.ps1, and VFS folders, was carefully engineered to execute a malicious PowerShell script and gain initial access to the target system. 

It leveraged the ‘runFullTrust’ capability to bypass security controls and execute with elevated privileges; also, the VFS folder contained files for future stages of the attack, such as a decryption tool for downloaded payloads. The threat actor distributed the trojanized MSIX files through malvertising campaigns, targeting unsuspecting users.

UNC4536, a malware distributor, uses NUMOZYLOD to deliver various payloads to its “business partners.” Two specific NUMOZYLOD variants were observed distributing CARBANAK and LUMMASTEALER. 

In the CARBANAK campaign, NUMOZYLOD gathered host information, downloaded CARBANAK, and executed it using DLL search order hijacking, while in the LUMMASTEALER campaign, a heavily obfuscated NUMOZYLOD variant delivered the LUMMASTEALER payload.

The NUMOZYLOD malware employs multi-layered obfuscation techniques to evade detection. By analyzing PowerShell script block logging and AMSI events, analysts can deobfuscate the malware and identify its malicious behavior. 

The malware first disables AMSI to bypass security measures, then downloads and executes a secondary payload from a C2 server, which is identified as LUMMASTEALER, gathers system information, and steals sensitive data.

Mandiant Hunt employs a multi-layered detection strategy to identify NUMOZYLOD malware, focusing on unusual file operations, PowerShell activity, and network connections. 

By analyzing events related to MSIX file distribution, “StartingScriptWrapper.ps1” creation, and Virtual File System folder interactions, security teams can detect early indicators of compromise.

The subsequent stages of the attack can be identified with the assistance of monitoring the execution of PowerShell for odd arguments, unexpected script locations, and policy changes.

Also Read:

MegaMedusa: The DDoS Tool Taking the Hacker World by Storm

See more