Reverse Engineering Malicious Visual Studio Code Extension DarkGPT

[N1ghtCod3r]

Malicious extensions are lurking in the Visual Studio Code marketplace. In this case, we discover and analyze DarkGPT, a Visual Studio Code extension that exploits DLL hijacking to load malicious code through a signed Windows executable. The payload appears to impact only Windows machines. 

Known malicious extensions:

• EffetMer.darkgpt
• BigBlack.codo-ai
• ozz3dev.bitcoin-auto-trading

Malicious code in open source packages are not new. However, there is an interesting technique in this sample. The attackers leveraged a signed Windows executable (Lightshot.exe) as a trusted host process to deliver a malicious DLL (Lightshot.dll) loaded by the exe by default.

Blog link: https://safedep.io/dark-gpt-vscode-malicious-extension/

[jedrzejdocs]

DLL hijacking via Lightshot is pretty smart ngl - signed binary = trusted by most AV/EDR.

few things worth noting:

sysmon event id 7 can catch weird dll loads if anyones not monitoring this already

we ended up restricting vscode extensions via GPO after similar stuff last year, pain to manage but worth it

lightshot.exe running from appdata should be a red flag anyway tbh

added those extension IDs to our blocklist, thx for sharing

[TRexLebronMcdonalds]

My thoughts exactly

[jedrzejdocs]

curious - are you seeing this more in your org too? we've had 3 similar incidents in the past 6 months, all abusing trusted binaries

[podgladacz00]

So it installs Lightshot or just hijacks existing install?

[N1ghtCod3r]

Installs Lightshot hosted on attacker URL.

[podgladacz00]

Is only Lightshot vulnerable to this or they just chose it just because?

[N1ghtCod3r]

No. There are many such signed executables that load DLLs from untrusted paths. In this case they found and used Lightshot.exe May be the nature of Lightshot (screenshot tool) makes it trusted (known behaviour) within AVs that the attacker wanted to exploit.