Malicious Python Scripts Abuse BoxedApp SDK to Hide and Run a DLL in Memory
Summary
Hunt researchers analyzed Python scripts that use the BoxedApp SDK to load a DLL from a password-protected archive in memory and relaunch a loader if it stops. The final payload could not be identified.
Key points
- Researchers found the scripts in an archive containing Python 3.8 files; it may be linked to SilverFox, but the attribution is not confirmed.
- The byte-compiled officehelper.py hides its execution window and uses the BoxedApp SDK to virtualize and load hello.dll without a conventional on-disk file.
- The loader extracts hello.dll from the password-protected hello.zip archive.
- The scriptforge.py watchdog uses a mutex and checks every eight seconds, restarting officehelper.py if its process is not running.
- The article says the SDK's virtualized execution can hinder file-based detection and analysis.
- Researchers could not determine the final malware verdict for the DLL.
Article Details
- Attack Vectors
- A zip archive containing byte-compiled Python scripts and a password-protected archive is used to conceal and deliver a DLL.
- officehelper.py uses the BoxedApp SDK to virtualize hello.dll and load it from memory.
- scriptforge.py checks every 8 seconds whether officehelper.py is running and relaunches it if it is not.
- The scripts hide their execution windows.
- Defensive Notes
- Use detection strategies that can identify malicious behavior beyond file-based and signature-based scanning.
- Monitor for suspicious use of BoxedApp SDK functions to create virtual files and load DLLs from memory.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 4f4dc75447d40c43a6ae3743d442a70aa57f8299728031e2d01056ca04ba60f1 | Hash of officehelper.py, identified as byte-compiled code that extracts and loads hello.dll. |
| SHA256 | 84a42aa1eafaa2ec7d10b85743adbe7fcf2f4a55beb3b36274edcab0b872b7e9 | Hash of scriptforge.py, identified as byte-compiled code used for persistence on a compromised host. |
| SHA256 | bf66eedcfcfa18dfa72ab81e9487a1cd009e210ab34f38dc9260568e169ffc8e | Hash of the password-protected hello.zip archive containing hello.dll. |
| SHA256 | e2361d2d3f547294c84c54901e5ec700100cbbfcc2aa41108e17df59e6e5a82b | Hash of hello.dll, identified as the suspicious DLL loaded by officehelper.py. |
| SHA256 | fa8109df69bfc045c272391b0a287e92e23767a40de9b9a9f1c3aec692a6e4aa | Hash of the original zip archive found on the virus-sample forum and potentially linked to the reported malware. |
MITRE ATT&CK
T1059.006 · PythonThe malware uses Python scripts, including officehelper.py and scriptforge.py, to carry out its activity.T1564.003 · Hidden WindowThe scripts hide their execution windows using Windows API calls.T1620 · Reflective Code Loadingofficehelper.py uses the BoxedApp SDK to virtualize hello.dll and load it directly from memory.