The fake installer drops three critical files: a legitimate executable named “Shine.exe,” a malicious DLL masquerading as “libcef.dll” (a legitimate Chromium Embedded Framework library), and a data file called “1.txt” containing encoded shellcode and the final payload. Netskope analysts identified this campaign during routine threat hunting activities, discovering that the fake installers deliver two primary malicious components: the Sainbox RAT, a variant of the notorious Gh0stRAT family, and a modified version of the open-source Hidden rootkit. When executed, the malicious MSI installer performs a deceptive dual operation, simultaneously installing the legitimate software to avoid user suspicion while deploying its malicious payload through a complex side-loading technique. The attack leverages fake installers masquerading as legitimate software downloads, including the popular AI chatbot DeepSeek, to deploy advanced persistent threats onto victim systems. This shellcode performs reflective DLL loading, injecting the Sainbox RAT directly into memory without touching the disk, thereby evading many traditional detection mechanisms and establishing a sophisticated command-and-control infrastructure for persistent system compromise. The malicious DLL subsequently reads the contents of “1.txt,” which contains a 0xc04-byte shellcode based on the open-source sRDI (Shellcode Reflective DLL Injection) tool. The core of this attack relies on DLL side-loading, a technique that exploits the Windows dynamic library loading process to execute malicious code. The malicious operation employs a multi-stage infection process that begins with carefully crafted phishing websites mimicking official software distribution pages. These counterfeit installers, primarily distributed as MSI files, contain sophisticated payloads designed to establish long-term system compromise while maintaining stealth through advanced evasion techniques. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 27 Jun 2025 14:20:12 +0000