www.esentire.com Open in urlscan Pro
104.20.162.46  Public Scan

Form analysis
0 forms found in the DOM

Text Content

BLOG


FAKEBAT MALWARE DISTRIBUTING VIA FAKE BROWSER UPDATES


BY eSentire Threat Response Unit (TRU)

April 22, 2024 | 6 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin





WANT TO LEARN MORE ON HOW TO ACHIEVE CYBER RESILIENCE?

TALK TO AN EXPERT

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are
staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate,
contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks
in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical
Threat Response and Advanced Threat Analytics driven by our Threat Response Unit
– the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a
recent threat investigation. We outline how we responded to the confirmed threat
and what recommendations we have going forward.

Here’s the latest from our TRU Team…


WHAT DID WE FIND?

In April 2024, eSentire’s Threat Response Unit (TRU) detected the FakeBat loader
being distributed through compromised websites. These websites contain injected
malicious JavaScript that triggers fake browser update notifications, misleading
users into believing they need to install legitimate browser updates.

This campaign has evolved from previous methods by fetching malicious links
directly from Pastebin and a linked domain, bypassing older techniques that used
embedded links on Telegra[.]ph.

Fake browser updates have been responsible for numerous malware infections,
including those of the well-known SocGholish. In 2023, ClearFake emerged,
distributing the Amadey modular loader via similar fake update mechanisms.

The infection chain started when the user visited the infected webpage (Figure
1).

Figure 1: Fake update page

Upon loading the compromised page, the injected malicious JavaScript code
triggers, which leads the user to the fake update page.

Figure 2: Malicious injected code

Prior to displaying the landing page, the function “can(callback)” sends a GET
request to a server to check if it should be displayed. This is determined based
on the server's response:

 * If the server returns true ("1"), it will call back (true), indicating that
   the necessary condition is met, and the landing page is displayed.
 * If the server returns a “false” response, the landing page is prevented from
   rendering (Figure 3).

Figure 3: “can(callback)” function

The “sendUpdateCounterRequest()” function could be used as part of a strategy to
control the exposure of a malicious page based on a visit counter. For example,
the server tracks the number of hits to deactivate the landing page display once
a preset threshold is reached.

This can be a tactic to evade detailed scrutiny once the page gets spotted by
security professionals or automated systems (Figure 4).

Figure 4: “sendUpdateCounterRequest()” function

The “insertScript” function sets up the conditions and environment where a
landing or phishing page might be displayed to the user. The function
dynamically alters the visibility and content of iframes on the page. It inserts
a new iframe that covers the entire view, effectively creating a new "landing
page" within the iframe.

This new content serves as a fake browser landing page, misleading users into
thinking they are interacting with a legitimate site. The script retrieves the
data from
doggygangers[.]com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/stats/get_stats.php.

If the data is not empty, the entire content of the body is replaced by
inserting a new iframe (the contents of the response shown in Figure 5) that
covers the whole viewport and serves as a fake update landing page.

Figure 5: Response from get_stats.php

If the data is empty, indicating that "isLand" returns false, a new iframe is
inserted into a cleared document body as specified by the srcdoc attribute. This
might serve as a fallback mechanism.

The contents of this srcdoc are similar to those retrieved from
doggygangers[.]com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/land/universal_land/.

However, the content from the latter includes additional comments; one such
comment contains the misspelled Russian word for "content." The phrase “Новое
содеccccржимое” is intended to mean "new content" (Figure 6).

Figure 6: Additional comments within /land/universal_land

Let’s analyze the content of the main malicious script – the landing page. When
the landing page loads, the script checks the user's browser type by examining
the “userAgent” string. This helps the script identify which browser the user
uses (e.g., Chrome, Firefox, Edge, Opera).

Based on the detected browser, the script sets variables like “browserName” and
“logoSrc”. The “logoSrc” is obtained by decoding a Base64 string corresponding
to an image URL, which is the logo of the detected browser. This personalization
makes the fake update page reflect the user’s current browser.

The script dynamically inserts the browser’s logo and modifies text elements on
the page to reflect the browser’s name, which reinforces the deception. The
function “replaceTextByLanguage(lang)” is responsible for displaying the text
content of a fake update landing page based on the user's browser language
settings (Figure 7).

Next, the script fetches the content from a PHP script on the server
(get_download_file_name.php), which further contains another PHP script
doggygangers.com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/downloadsdownloadfile/dwnl_standart[.]php.

The PHP script redirects the user to the final page serving FakeBat MSIX payload
named “UpdateSetup-x86” (MD5: 569d206636b75c33240ba4c1739c04d6) (Figure 8).

It’s worth mentioning that the MSIX file is signed with “Consoneai Ltd”, the
same signature was previously used by FakeBat on other MSIX payloads (MD5:
06165e8da7bf1b22962c8272f19d707f).

Figure 7: “replaceTextByLanguage(lang)” functionFigure 8: Page serving the
FakeBat MSIX payload


FAKEBAT

Unlike the campaign we analyzed in our previous blog, this campaign no longer
embeds malicious links within Telegra[.]ph pages. Instead, it directly retrieves
them from Pastebin and another website (seacraftsgallery[.]com).

Notably, the IP address of this other website is also associated with the domain
hosting the landing page, doggygangers[.]com. The content of the Pastebin link
includes code to bypass AMSI (Antimalware Scan Interface) (Figure 9).

Figure 9: Snippet of AmsiBypass code

Interestingly, if we investigate the author of the Pastebin paste, we find the
handle “assop875@proton.me” (Figure 10). This handle was also associated with
the creation of malicious PowerShell payloads on the HuggingFace platform back
in 2022, as mentioned in our previous blogs.

Figure 10: Mention of “assop875@proton.me” handle

The rest of the infection steps are similar to our previous analysis, with Payk
RunPE dropping LummaC2.

The FakeBat campaign showcases a sophisticated phishing tactic using fake
browser updates, likely orchestrated by various threat actors who have acquired
the FakeBat loader. Initially spread through Google ads, this threat has
expanded its reach by employing fake updates.


WHAT DID WE DO?

Our 24/7 SOC Cyber Analysts investigated the suspicious activities, notified the
client, and isolated the affected device.


WHAT CAN YOU LEARN FROM THIS TRU POSITIVE?

 * The FakeBat campaign implements sophisticated social engineering by mimicking
   legitimate browser update prompts that match the user's browser type and
   language.
   * This targeted approach indicates the need for increased user awareness
     about the authenticity of update notifications and the sources from which
     updates are downloaded.
 * The use of server-side logic to determine whether or not to display a
   malicious page, based on a visit counter, highlights a method by which
   attackers can manage their campaigns to evade detection.
   * This underscores the importance of real-time monitoring and adaptive
     security defenses to counteract dynamic threat behaviors.
 * The detailed analysis of the infection chain and the use of specific PHP
   scripts to ultimately serve the FakeBat MSIX payload illustrates the layered
   nature of the malware distribution networks.
   * This calls for advanced endpoint protection solutions that can detect and
     block such multi-stage attack vectors.


RECOMMENDATIONS FROM OUR THREAT RESPONSE UNIT (TRU) TEAM:

 * Ensure that all endpoints are protected with up-to-date antivirus software or
   Endpoint Detection and Response (EDR) tool capable of detecting and blocking
   malicious files.
 * Implement a Phishing and Security Awareness Training (PSAT) program that
   educates and informs your employees on emerging threats in the threat
   landscape.
 * Control MSIX execution via AppLocker.


INDICATORS OF COMPROMISE

You can access the indicators of compromise here.


REFERENCES

 * https://www.bridewell.com/insights/blogs/detail/clearfake-campaign
 * https://www.esentire.com/blog/recent-fakebat-activity-observed-in-december-2022
 * https://www.esentire.com/blog/the-return-of-the-bat-fakebats-payk-runpe-arsenal
 * https://learn.microsoft.com/en-us/windows/msix/desktop/managing-your-msix-deployment-enterprise



ESENTIRE UNIT

The eSentire Threat Response Unit (TRU) is an industry-leading threat research
team committed to helping your organization become more resilient. TRU is an
elite team of threat hunters and researchers that supports our 24/7 Security
Operations Centers (SOCs), builds threat detection models across the eSentire
XDR Cloud Platform, and works as an extension of your security team to
continuously improve our Managed Detection and Response service. By providing
complete visibility across your attack surface and performing global threat
sweeps and proactive hypothesis-driven threat hunts augmented by original threat
research, we are laser-focused on defending your organization against known and
unknown threats.




READ THE LATEST FROM ESENTIRE

Apr 30, 2024

ESENTIRE NAMED A LEADER IN 2024 IDC MARKETSCAPE FOR MANAGED DETECTION AND…

Learn More
Apr 29, 2024

D3F@CK LOADER, THE NEW MAAS LOADER

Learn More
Apr 22, 2024

FAKEBAT MALWARE DISTRIBUTING VIA FAKE BROWSER UPDATES

Learn More

Cookies allow us to deliver the best possible experience for you on our website
- by continuing to use our website or by closing this box, you are consenting to
our use of cookies. Visit our Privacy Policy to learn more.

Accept
ARE YOU EXPERIENCING A SECURITY INCIDENT OR HAVE YOU BEEN BREACHED?
Call 1-866-579-2200


THE PROVEN CHOICE FOR
MANAGED DETECTION AND RESPONSE

GET STARTED → PARTNER LOGIN →


SALES AND
CUSTOMER SUPPORT

NORTH AMERICA 1-866-579-2200 EMEA (0)8000-443242 ANZ/APAC 1-519-651-2200

WHAT WE DO

Managed Detection and Response Digital Forensics and Incident Response Exposure
Management Services Extended Detection and Response (XDR) Security Operations
Center (SOC) Threat Response Unit (TRU) Cyber Resilience Team MDR for Microsoft
MDR for AWS Response and Remediation MDR Pricing

HOW WE DO IT

Network Endpoint Log Cloud Insider Threat

INDUSTRIES

Insurance Construction Finance Legal Manufacturing Private Equity Healthcare
Retail Food Supply Government and Education

USE CASES

Ransomware Third-Party Risk Sensitive Data Security Cloud Misconfiguration Zero
Day Attacks Cyber Risk Cybersecurity Compliance Do More With Less Cyber
Insurance

RESOURCES

Security Advisories Blog Resource Library Video Library TRU Intelligence Center
Case Studies Switch to eSentire Real vs Fake MDR Cybersecurity Glossary

TOOLS

Cybersecurity Assessment MDR ROI Calculator SOC Calculator MITRE ATT&CK® Tool

COMPANY

About Us Leadership Newsroom Event Calendar Careers Partners Australia & New
Zealand United Kingdom

2024 eSentire, Inc. All Rights Reserved.

Sitemap Terms and Conditions Privacy Policy Accessibility Legal
Get Started

What We Do
How We Do It
Resources
Company
Partners
Get Started
What we do
How we do it
Resources
Company
Partners
Get Started