PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users
JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.
PAPERMILL delivers ISO disk images via tax-audit phishing emails that passed SPF, DKIM, and DMARC, containing a renamed Authenticode-signed Notepad++ executable and a malicious libcurl.dll that proxies curl functions while executing loader logic in DllMain. The chain uses Mark-of-the-Web bypasses, anti-sandbox sleeps, UAC elevation prompts, Registry persistence, and a Donut shellcode loader to reflectively load .NET VenomRAT v6.0.3 with HVNC and credential-stealing capability, with C2 at 154.36.188.201:4449. JUMPSEC assesses the campaign as China-nexus, financially motivated, and Silver Fox-adjacent rather than definitively Silver Fox-operated.
- ISO attachments strip Mark-of-the-Web metadata, weakening SmartScreen warnings
- Signed Notepad++ binary sideloads malicious libcurl.dll exporting four curl functions
- Loader sleeps five minutes under sandbox checks and prompts repeatedly for UAC
- VenomRAT v6.0.3 with HVNC identified via PBKDF2 salt and D/Invoke artifacts
- C2 traffic points to 154.36.188.201:4449
- ATT&CK
- T1566.001 Spearphishing AttachmentT1553.005 Mark-of-the-Web BypassT1574.002 DLL Side-LoadingT1620 Reflective Code LoadingT1112 Modify Registry
- Threat actors
- PAPERMILLSilver Fox
- Malware
- VenomRAT
- Organizations
- GBHackers
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 17dlz.cn | [.]cc Sending IP 155.94.154.195 Sending MTA (HELO/PTR) mos1.17dlz[.]cn Bulk-mailer auth host smtp.smtpman[.]cn Note: IP addresse |
| domain | hsaui.cc | promise Type Indicator Sender address / DKIM domain dfgfasd@hsaui[.]cc Sending IP 155.94.154.195 Sending MTA (HELO/PTR) mos1.17d |
| domain | smtpman.cn | g MTA (HELO/PTR) mos1.17dlz[.]cn Bulk-mailer auth host smtp.smtpman[.]cn Note: IP addresses and domains are intentionally defanged |
| ipv4 | 154.36.188.201 | ed process handling. The recovered configuration pointed to 154.36.188.201:4449 and identified the implant as Venom RAT + HVNC + Steal |
| ipv4 | 155.94.154.195 | Sender address / DKIM domain dfgfasd@hsaui[.]cc Sending IP 155.94.154.195 Sending MTA (HELO/PTR) mos1.17dlz[.]cn Bulk-mailer auth hos |
From the original article
4 min read at gbhackers.com
A newly identified phishing operation tracked as PAPERMILL is abusing a legitimately signed Notepad++ executable, DLL sideloading, and layered in-memory loaders to install VenomRAT on Windows systems. The campaign uses tax-audit lures aimed at Indian recipients and reflects a broader China-nexus pattern of tax-themed malware activity, although the available evidence does not support definitive attribution […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.