{"id":1532,"date":"2024-04-16T08:07:02","date_gmt":"2024-04-16T08:07:02","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1532"},"modified":"2024-04-22T09:41:26","modified_gmt":"2024-04-22T09:41:26","slug":"hacktool-win32-nppspy","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2024\/04\/16\/hacktool-win32-nppspy\/","title":{"rendered":"HackTool.Win32.NppSpy"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Hacktool
\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Moderate<\/p>\n

 <\/p>\n

Malware Name(s)<\/h3>\n
    \n
  • (Padvish) HackTool.Win32.NppSpy<\/li>\n
  • (Avira) TR\/PSW.Agent.zmiws<\/li>\n
  • (Kaspersky)Trojan-PSW.Win32.Lognot.e<\/li>\n<\/ul>\n

    <\/h3>\n

    What is HackTool?<\/h3>\n

    Hacktools are tools designed to facilitate intrusion. These tools can be used by an intruder to receive data from the victim organization\u2019s network. These tools are commonly used to retrieve credentials information of sensitive victim servers. For example, an intruder can use hacktools to guess passwords based on Brute Force attacks. In some cases, to escalate access levels and exploit existing vulnerabilities, HackTools are used. In general, hack tools can crash the computer and network security barriers and provide various capabilities to infiltrate systems.<\/p>\n

    <\/h3>\n

    What is NppSpy Malware?<\/h3>\n

    NppSpy is an intrusion tool designed to steal user login credentials by masquerading its file as a Network Provider. Each Network Provider functions as a Windows Dynamic Link Library (DLL), facilitating the system’s compatibility with distinct network protocols. These files are automatically invoked by a system process upon user login or password modification, thereby transmitting related username and password data. Exploiting this mechanism, NppSpy malware registers its malicious file as a Network Provider. Consequently, it intercepts system notifications during login or password modification events, then it accesses sensitive user information, including usernames and passwords. This malware openly stores the obtained data in a file on the hard disk.<\/p>\n

     <\/p>\n

    Technical Review<\/h2>\n

    Indicators of Compromise (IoC)<\/h3>\n

    ? Detection of suspicious DLL files (the registered files as Network Providers are located in the following path:<\/p>\n

    %SystemRoot%\\System32\\<\/span><\/p>\n

    ? Detection of suspicous file containing system user credentials, commonly found at:<\/p>\n

    SystemRoot%\\temp\\msedge_installers.zip%<\/span><\/p>\n

    SystemRoot%\\debug\\debug.evtx%<\/span><\/p>\n

     <\/p>\n

    Performance Description<\/h3>\n

    The main file of this tool comprises a DLL file, which is meticulously registered as a Network Provider within the targeted system. To achieve this, the malware deploys a PowerShell script like the one depicted in image 1. This script registers the main malware file (designated as Ntkerbo.dll within the System32 directory) as a Network Provider and initiates the creation of the requisite service.<\/p>\n

     <\/p>\n

    \"\u0627\u0633\u06a9\u0631\u06cc\u067e\u062a<\/p>\n

    Image 1 – Malware Powershell script for registering Network Provider<\/p>\n

     <\/p>\n

    When the user logs in the system, the Winlogon.exe process sends the username and password entered by the user to the mpnotify.exe process for authentication. This process also reads the Network Providers registered in the system from the following registry key and after loading the library file corresponding to them, it sends the login information openly to the NPLogonNotify function implemented in these files.<\/p>\n

     <\/p>\n

    \u201dHKLM\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order\\ProviderOrder\u201c<\/span><\/p>\n

    Upon password alteration, the lsass.exe process loads and executes the registered Network Provider files.<\/p>\n

    NppSpy saves stolen login credentials explicitly into a file on the victim’s disk, as illustrated below:<\/p>\n

    \u201cUsername -> password\\r\\n\u201d<\/span><\/p>\n

    \"\u06a9\u062f<\/p>\n

    Image 2 – Code snippet showcasing user data storage within the NPLogonNotify function<\/p>\n

    Image 3 illustrates the loading of the malware library file in the lsass.exe process, then its malicious activity, which involves logging the acquired information into a file on the hard disk:<\/p>\n

     <\/p>\n

    \"\u0627\u062c\u0631\u0627\u06cc<\/p>\n

    Image 3 – Execution of the malware file during password modification by the lsass.exe process<\/p>\n

     <\/p>\n

    How to deal with and clean the system<\/h2>\n

    Padvish antivirus effectively detects and removes this malware from infected systems. To prevent infection, it is recommended to:<\/p>\n

    \u2705Keep Your Antivirus Up to date<\/p>\n

    \u2705Only download files or software from trusted sources and websites.<\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Overview Type: Hacktool Destruction Level: High Prevalence: Moderate   Malware Name(s) (Padvish) HackTool.Win32.NppSpy (Avira) TR\/PSW.Agent.zmiws (Kaspersky)Trojan-PSW.Win32.Lognot.e What is HackTool? Hacktools are tools designed to facilitate intrusion. These tools can be used by an intruder to receive data from the victim organization\u2019s network. These tools are commonly used to retrieve credentials information of sensitive victim servers.…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[56,67,68],"class_list":["post-1532","post","type-post","status-publish","format-standard","hentry","category-hacktool","tag-hacktool","tag-hacktool-win32-nppspy","tag-nppspy"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1532"}],"version-history":[{"count":3,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1532\/revisions"}],"predecessor-version":[{"id":1535,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1532\/revisions\/1535"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}