SilentFade

SilentFade could determine accounts that already had linked payment methods, so that attackers could run ads and pay for them using the account owner’s payment method.

SilentFade is often bundled with potentially unwanted programs (PUP) in pirated copies of popular software, and is likely downloaded by other malware as well.

Use of popular and smaller URL-shorteners to hide the landing page... Heavy use of cloaking and traffic redirection.

The service is responsible for persistence across reboots and for dropping 32-bit and 64-bit version DLLs... in Chrome’s application directory. This is done for the purpose of DLL hijacking...

This is done for the purpose of DLL hijacking so that the malicious DLL is loaded by Chrome in place of the real winhttp.dll.

SilentFade could determine accounts that already had linked payment methods, so that attackers could run ads and pay for them using the account owner’s payment method.

The cloaking service would decide whether to send a user to the malicious page or an innocuous one based on the geolocated IP address of the user clicking on the ad, the presence of the correct HTTP Referer header, and other features.

The downloader application either downloads a standalone malware component or a Windows service installed as either ‘AdService’ or ‘HNService’. The service is responsible for persistence across reboots...

As soon as SilentFade accessed Facebook accounts from an infected machine, it explicitly called the appropriate web endpoints to disable notifications.

SilentFade could determine accounts that already had linked payment methods, so that attackers could run ads and pay for them using the account owner’s payment method.

The downloader application either downloads a standalone malware component or a Windows service installed as either ‘AdService’ or ‘HNService’. The service is responsible for persistence across reboots...

Since then, SilentFade has resorted to using string obfuscation to make it more difficult to hunt for malware samples and to complicate AV detection signatures.

The service is responsible for persistence across reboots and for dropping 32-bit and 64-bit version DLLs (usually as winhttp.dll or winmm.dll) in Chrome’s application directory.

With these changes, SilentFade minimized the likelihood of users noticing unrecognized activity on their accounts – preserving undetected access to compromised accounts for longer.

SilentFade could determine accounts that already had linked payment methods, so that attackers could run ads and pay for them using the account owner’s payment method.

The cloaking service would decide whether to send a user to the malicious page or an innocuous one based on the geolocated IP address of the user clicking on the ad, the presence of the correct HTTP Referer header, and other features.

The authors discovered that the confidence checks performed by the account-blocking web UI were incomplete in the server-side code, which was subsequently exploited by SilentFade. This bug allowed SilentFade to block both the Login Alerts and Facebook Business pages and ensured that users could not unblock the pages even if they tried.

Samples in this family often contain code to detect virtual machines and halt execution when detected, to thwart automated and manual analysis attempts.

This is achieved by checking the description field of all available display drivers against ‘Virtual’ or ‘VM’.

The service is responsible for persistence across reboots and for dropping 32-bit and 64-bit version DLLs... in Chrome’s application directory. This is done for the purpose of DLL hijacking...

This is done for the purpose of DLL hijacking so that the malicious DLL is loaded by Chrome in place of the real winhttp.dll.

As soon as SilentFade accessed Facebook accounts from an infected machine, it explicitly called the appropriate web endpoints to disable notifications.

Cookies are more valuable than passwords because they contain session tokens, which are post-authentication tokens... Session tokens, on the other hand, are only issued after a successful login so the attackers can use them to bypass multi-factor authentication enabled by the user.

Once installed, the malware stole Facebook credentials and cookies from various browser credential stores, including Internet Explorer and Chromium clones, with support for Firefox added later on.

As soon as SilentFade accessed Facebook accounts from an infected machine, it explicitly called the appropriate web endpoints to disable notifications.

Samples in this family often contain code to detect virtual machines and halt execution when detected, to thwart automated and manual analysis attempts.

This is achieved by checking the description field of all available display drivers against ‘Virtual’ or ‘VM’.

All Chromium and Firefox-based browsers store credentials and cookies in SQLite databases, which are accessible once you have executable code running on an infected endpoint.

The data was then sent back as an encrypted JSON blob through custom HTTP headers...

Some variants have the ability to download additional payloads from their C2 servers. However, the C2 simply provides URLs to the payloads...

The cloaking service would decide whether to send a user to the malicious page or an innocuous one based on the geolocated IP address of the user clicking on the ad, the presence of the correct HTTP Referer header, and other features.

The data was then sent back as an encrypted JSON blob through custom HTTP headers (usually through Server and Server-Key or MicroServer and MicroServer-Key).