eSentire’s Threat Response Unit (TRU) uncovered a sophisticated malware campaign involving fake browser updates.
This campaign has been responsible for delivering two dangerous malware variants:BitRAT and Lumma Stealer.
The attackers use fake update mechanisms to trick users into downloading malicious files, leading to severe security breaches.
eSentire’s TRU detected an instance of fake updates delivering BitRAT and Lumma Stealer. This method of attack has been increasingly common, with fake browser updates being a popular lure among cybercriminals.
The infection chain begins when a user visits an infected webpage containing injected malicious JavaScript code.
This code redirects the user to a phony update page.
All-in-One Cybersecurity Platform for MSPs to provide full breach protection with a single tool, Watch a Full Demo
The malicious JavaScript code is hidden within the webpage and only activates if the HTTP referrer matches the original malicious web page.
The fake update page, hosted on the chatgpt-app[.]cloud site, contains a download link to a ZIP archive called ‘Update.zip’.
This archive is automatically downloaded onto the victim’s device and is hosted on Discord’s Content Distribution Network (CDN).
The ZIP archive contains a JavaScript file (Update.js) that acts as an initial downloader to retrieve the payloads once executed by the victim.
Several PowerShell scripts within the archive are responsible for downloading and executing the next stage loader and payloads from a known BitRAT Command-and-Control (C2) address.
The attack involves multiple files, each serving different purposes:
The PowerShell script bypasses AMSI, renames the payload 0x.png to 0x.log, hides it in the C:\Users\Public directory, and sets it to run at startup by modifying the Registry Run Key.
The 0x.log (0x.png) payload contains an additional PowerShell script which acts as a persistence mechanism for the BitRAT payload file, a.png.
The 0x.log file downloads a.png and executes it.
The loader mechanism in the payload files a.png and s.png is almost identical, with the only difference being the hash itself.
The loader is a .NET portable executable (PE) file, obfuscated using Crypto Obfuscator (5.x).
It loads the decrypted payload binary from the files PowerShell script and injects it into RegSvcs.exe.
BitRAT is a feature-rich remote access tool with capabilities such as:
The BitRAT sample analyzed was UPX-packed and contained an encrypted configuration.
The decryption routine involves several steps, ultimately using the first 16 characters from an MD5 hash as the key for the Camellia decryption routine.
Lumma Stealer, also known as LummaC2 Stealer, is an information-stealing malware developed in C language.
It targets cryptocurrency wallets, 2FA browser extensions, and other sensitive data on victims’ machines.
The stolen data is sent to a C2 server via HTTP POST requests with the user agent beginning with “Mozilla/5.0”.
The use of fake updates to deliver a variety of malware displays the operator’s ability to leverage trusted names to maximize reach and impact.
The .NET loader being the same in both payload files shows the likelihood of the fake update loader being a malware delivery service.
The malware payload is likely interchangeable, and various types will be loaded in similar incidents in the future.
Get special offers from ANY.RUN Sandbox. Until May 31, get 6 months of free service or extra licenses. Sign up for free.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…