DeerStealer

users who search for popular keywords are shown malicious ads that purport to be from an official vendor... Today, we show yet another example of brand misuse... the Google ad that was involved in tricking users into visiting a decoy website.

We see a number of redirects via intermediary domains controlled by the attacker, before landing on a fake site for Authenticator. Fake site leads to signed payload hosted on Github

Key components in observed attack chains involve the use of the ClickFix initial access method, where victims are redirected to a phishing page prompting the user to execute a malicious command in the Windows Run Prompt.

For a targeted user, the script displays a highly convincing, yet fake, pop-up alert urging to update the browser used (e.g. Google Chrome or Mozilla Firefox).

T1053.005 Persistence Scheduled Task/Job: Scheduled Task zceWriter, dyApp, Pluginsecurity_dbg

When the “Update” button was clicked, an MSI file was downloaded and the webpage displayed instructions on how to install the payload.

If a Mac user outside of North America visited the compromised website from a web browser, they were redirected to a fake update page that, if the Update button was clicked, downloaded and installed an information stealer.

T1053.005 Persistence Scheduled Task/Job: Scheduled Task zceWriter, dyApp, Pluginsecurity_dbg

TA2726 appears to be a traffic seller and operates a TDS that can serve other threat actors to facilitate their malware distribution.

T1547.001 Persistence Registry Run Keys HKCU Run key "AppVTemplate"

T1053.005 Persistence Scheduled Task/Job: Scheduled Task zceWriter, dyApp, Pluginsecurity_dbg

The purpose of the next stage is to module stomp the legitimate binary input.dll with core HijackLoader shellcode . The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state, the HijackLoader configuration is decrypted/parsed from Kleanmean.py , and the DeerStealer payload is written to a new section in the inject process.

The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state

T1547.001 Persistence Registry Run Keys HKCU Run key "AppVTemplate"

DeerStealer employs a significant amount of obfuscation, in order to hinder the analysis process and evade antivirus signatures.

the whole premise of these attacks relies on social engineering... some unknown individual was able to impersonate Google and successfully push malware disguised as a branded Google product

T1036.005 Defense Evasion Masquerading: Match Legitimate Name "Antonomasia" by "Cyme" + Active@ Password Changer decoy

The purpose of the next stage is to module stomp the legitimate binary input.dll with core HijackLoader shellcode . The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state, the HijackLoader configuration is decrypted/parsed from Kleanmean.py , and the DeerStealer payload is written to a new section in the inject process.

The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state

the purpose of this stage is to resolve APIs and read/decrypt the next stage.

TA2726 appears to be a traffic seller and operates a TDS that can serve other threat actors to facilitate their malware distribution.

Unique jump-tables/simple virtual machines are used to decrypt the C2 URL and strings used throughout

Looking at the file itself, we can see that it has been digitally signed by “Songyuan Meiying Electronic Products Co., Ltd.” just one day before, and the signature is still valid

Hidden Spyware modules (HVNC, Clipper, Live Keylogger)

stored cookies, passwords, autofill, and credit cards are harvested. Cookies from Chromium based browsers are retrieved from memory following successful communications with the C2 server.

stored cookies, passwords, autofill, and credit cards are harvested.

More than 50+ web browsers are targeted by Deer Stealer where stored cookies, passwords, autofill, and credit cards are harvested.

including the InstallDate, InstallTime, machine GUID from the registry keys below

The initial request to the C2 proxy contains several identifiers to fingerprint the victim machine, including the InstallDate, InstallTime... and the machine’s processor name.

T1083 Discovery File and Directory Discovery System enumeration

Unique jump-tables/simple virtual machines are used to decrypt the C2 URL and strings used throughout

Through the file grabber module, threat actors can retrieve files from victim machines by specifying rules, or in other words, paths and file extensions to exfiltrate.

Hidden Spyware modules (HVNC, Clipper, Live Keylogger)

T1074.001 Collection Data Staged: Local Data Staging SQLite databases (ribs_collection, ribs_payload)

DeerStealer allows threat actors to target the clipboard of victim machines for substitution of threat actor supplied crypto-wallet addresses.

exfiltrates the stolen data in form of PKZIP archives

Indicators of Compromise... C2s vaniloin[.]fun mundoparachicas[.]space

Communication with the C2 proxy happens over HTTPS

the malicious binary is hosted on the Github repository

TA2726 appears to be a traffic seller and operates a TDS that can serve other threat actors to facilitate their malware distribution.

Hidden VNC capability for stealthy remote desktop control

Subsequent requests contain encrypted zip files containing harvested information.

The malware, DeerStealer, is a kind of stealer that will grab and exfitrate your personal data via an attacker-controlled website hosted at vaniloin[.]fun .