Back to threat feeds
Noblox.js
NPM Packages mimics Roblox API code to deliver MBRLocker ransomware
NPM packages disguised as Roblox libraries deploy ransomware, threat actors carry solicit payment through Discord servers...
Continue reading
NPM packages disguised as Roblox libraries deploy ransomware, threat actors carry solicit payment through Discord servers...
Continue reading
NPM packages disguising as Roblox libraries that deliver ransomware were **discovered** by Sonatype last month. The malicious NPM packages infect systems with MBRLocker ransomware. Two Typosquatting packages Noblox.js-proxy and Noblox.js-proxies imitate a Roblox game API wrapper, noblox.js. **Noblox.js** is an open-source JavaScript API that has approximately 700,000 downloads. NPM's security team promptly took down both packages after it was reported.
The packages look like the legitimate NPM page that displays the README for the Noblox package. File package.json launches 'postinstall.js' that contains a suspicious piece of obfuscated code amidst plain readable functions. When the script is executed, it launches another heavily obfuscated batch file named nobox.bat.
Noblox.bat downloads the following malicious files:
The one-lined script attempts to disable antivirus agents in the system to avoid detection.
The primary functionality is to steal Discord tokens and the stored browser and system credentials. Additionally, it drops several files, including stealer.exe. To set up persistence, it copies itself to Microsoft Update Manager.
The .NET executable uses IlSpy or dnSpy to reconstruct the source code. It drops a text file containing the string _"UR NEXT"_ that changes the Windows user account name.
A remote access trojan that installs MBRLocker called- Monster Ransomware.
The ransomware references a discord server 'condos' for communication; discord is commonly used by threat actors for collaboration on host systems and to solicit payment. The majority of users are below the age of 13, and the estimated number of installs is approximately 200.
Discord has either ignored or delayed the reports submitted to their Trust and Safety team. The server currently has 50,000 members and mainly targets sexual games with minors.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
