New Malware Abuses Azure Functions to Host Command and Control Infrastructure

A malicious ISO image named Servicenow-BNM-Verify.iso was uploaded to VirusTotal from Malaysia, according to VirusTotal. The image contains four files, with a visible Windows shortcut, servicenow-bnm-verify.lnk, which launches PanGpHip.exe, a Palo Alto Networks binary, and two hidden components, including libwaapi.dll, a malicious DLL side-loaded by the Palo Alto executable.

The core of the attack lies in wa_api_setup inside libwaapi.dll, which carries out in-memory payload injection after obtaining a mutex and decrypting a hidden payload via RC4, using a SHA-256 hash of a specific string as the key. The injected shellcode unpacks a DLL and then enters a loop that sends victim data to logsapi.azurewebsites[.]net/api/logs, hosting Azure Functions as its command and control backend.

Initial analysis notes module unhooking to evade detection, and the final payload appears to profile compromised hosts by transmitting system metadata, including architecture, OS build, and user names. A similar DLL with the same imphash surfaced on VirusTotal from Singapore on 5 September 2025, suggesting a campaign spanning multiple regions.