#ParsedReport #CompletenessHigh
13-10-2026

MALFEX Moves Its npm Loader into a Native Windows DLL

https://safedep.io/malfex-imgdecode-npm-native-addon-loader

Report completeness: High

Actors/Campaigns:
Malfex

Threats:
Native_loader
Malfex
Overlord_tool
Process_injection_technique
Movinlike
Supply_chain_technique

Victims:
Windows developers, Software development

Geo:
Brazil, Portuguese

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1027, T1027.013, T1036, T1053.005, T1055, T1059, T1059.001, T1070.003, T1071.001, have more...

IOCs:
File: 21
Url: 3
Path: 5
Email: 1
IP: 1
Hash: 6

Soft:
Node.js, Microsoft Visual C++, Chromium, Chrome, Component Object Model, Discord, Steam, Minecraft, Telegram, WinHTTP, have more...

Algorithms:
sha256, base64, aes-256-cbc, aes, xor

Functions:
exec, decode, getAsset, readFileSync, require, GetConsoleMode, WriteProcessMemo, CreateRemoteThre

Win API:
VirtualAlloc, RtlMoveMemory, CreateThread, CreateProcessW, VirtualAllocEx, WriteProcessMemory, VirtualProtectEx, CreateRemoteThread, ResumeThread, TerminateProcess, have more...

Languages:
javascript, powershell

Platforms:
amd64

YARA: Found