FakeBat Continues Signed MSIX App Package Abuse

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

This blog was updated in September 2023 based on research from TRU that identifies this as FakeBat. This blog originally identified this threat as FakeBat.

What did we find?

In July, the eSentire Threat Response Unit (TRU) identified multiple FakeBat cases investigated by our SOC team. In these cases, the victims fell for suspected malicious advertisements impersonating Zoom and TradingView after performing web searches for these products.

The victims had then downloaded malicious MSIX installer files (such as Zoom-x64.msix) which attempted to infect their systems with Redline Stealer and SectopRAT. These were the first such observations in our telemetry since May 2023. Our analysis here will focus on discovering imposter websites and MSIX samples currently being used in FakeBat campaigns.

FakeBat Imposter Sites Registered on June - July 2023

TRU identified several suspected FakeBat payload sites hosted on IP 80.68.159.10 registered in June and July 2023:

• tradling-view[.]com
• get-adobe[.]net
• zooml-us[.]com
• open-aii[.]com
• mldiourney[.]com
• store-steampowered[.]net
• mlcrosoft-online[.]net
• qul-cken[.]com

The domain names suggest an array of brands are impersonated in these attacks, including Microsoft, Zoom, Adobe, Steam, OpenAI, etc. (a more complete list can be found at the end of this blog). These brands have been used historically in previous FakeBat attacks, and landing pages comprise of an imposter download page for these products.

When visited manually, these sites present empty content or 403 HTTP errors, and successful recreation of infection chains has been minimal thus far. This may suggest operators may have improved the cloaking of these sites to evade discovery by researchers and scanners.

We did identify one successfully rendered page for Steam (store-steampowered[.]net) submitted to Urlscan.io on June 6, which shows an imposter page for the gaming service. The website was registered the same day and served a legitimate Steam binary at the time.

We assess this site likely served Steam-x64.msix (md5: c37aee1ebad9b0f7bd2e7755a3133d0e) in mid-July 2023 shown in Figure 2 below.

FakeBat Continues to Abuse Signed MSIX Packages

As we covered in our May blog, MSIX files are a relatively new installer format designed for Windows 10 and above. It requires the package contents to be signed; a barrier intended to limit abuse by threat actors. Unfortunately, these code signing certificates do find their way into threat actor hands and can be acquired on underground forums for a fee.

In a February post on XSS forums, a suspected FakeBat operator vouched for a code signing service offered by another forum member by providing a screenshot of their previous transaction with this member:

It's highly probable that FakeBat operators are purchasing the required code signing certificates used in their campaigns from other threat actors.

The latest MSIX app packages reviewed by TRU contained content signed by IMPERIOUS TECHNOLOGIES LIMITED, a private limited company based out of the UK.

The AppManifest shows the package was created with Advanced Installer version 20.2 configured with Russian-language settings.

When launched, the package executes with elevated privileges then executes an embedded PowerShell script then drops and executes a legitimate copy of the Steam installer as a decoy. The PowerShell script (“NEW_mormons_v1.ps1”, MD5: d87bc0bcfa1976ffa6a165545fb7ca62) contains a similar structure to prior samples, with some minor updates. It downloads Redline Stealer binary disguised as a jpg file (“czx.jpg”, MD5: d5a1d54158e110a8d9b0eea06d37e26f) from hxxps://tatmacerasi[.]com and SectopRAT/ArechClient (“zhelp.exe”, MD5: 3AC860860707BAAF32469FA7CC7C0192) from hxxps://fullpower682[.]store.

Additional details on the PowerShell script can be seen in the annotated image below.

Similarities with prior FakeBat samples include:

• MSIX created with Advanced Installer v. 20.2 with Russian language option
• Decoy executable
• PowerShell execution via signed MSIX
• PowerShell behavior:
  • One or more execution delays via sleep command
  • Connect to C2 to signal “start”
  • Download payload from URL ending in .jpg
  • Connect to C2 to signal “install”
  • Load payload assembly using PowerShell

A May PowerShell sample for comparison:

Payloads

SectopRAT is downloaded as an encrypted RAR archive and decrypted using 7zip (also downloaded). The SectopRAT payload (MD5: DD50DE3ACC26293986F40EB04F0F1A99) is written to AppData\Local\Temp\ and injected into MsBuild.exe. It retrieves its C2 configuration from Pastebin and connects to 194.26.135[.]180 for command and control.

Redline Stealer is loaded as assembly by PowerShell, with the resulting payload (MD5: D5A1D54158E110A8D9B0EEA06D37E26F) connecting to 194.26.135[.]119 port 12432 for command-and-control.

For a complete analysis of another Redline sample, read our Redline Stealer malware analysis.

How did we find it?

• MDR for Endpoint identified MSIX activity and blocked subsequent behavior.

What did we do?

• Our team of 24/7 SOC Cyber Analysts isolated the host and alerted the customer while an investigation took place before remediating the threat.

What can you learn from this TRU positive?

• Imposter sites distributed via ad platforms (such as Google Ads) have diminished since the start of 2023 but remain a concern. It’s probable these ad services have improved their processes to tamp down on abuse, but it’s also apparent that threats like FakeBat have improved their tradecraft to circumvent these controls.
• Targeted brands include products and services commonly found in business environments. Infected, domain-joined systems offer more value for data theft and follow-on intrusion attacks (e.g. ransomware).
  • Both Redline and SectopRAT provide a foundation to monetize infected assets and exploit them for further intrusion actions.
• Signed code is a barrier that can be circumvented. Code signing certificate services can be acquired from criminal forums for a fee; FakeBat has likely used these services to sign MSIX packages.
• Suspicious MSIX execution can be identified by monitoring for PowerShell (or other script formats) execution under aistubx64.exe.
  • For example: svchost.exe -> aistubx64.exe -> PowerShell.exe

Recommendations from our Threat Response Unit (TRU):

• Protect endpoints against malware by:
  • Ensuring antivirus signatures are up-to-date.
  • Using a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) tool to detect and contain threats.
• Raise awareness of malware masquerading as legitimate applications, and include in your Phishing and Security Awareness Training (PSAT) program. An effective PSAT program emphasizes building cyber resilience by increasing risk awareness, rather than trying to turn everyone into security experts.
• Windows Defender Application Control provides options for managing packaged apps (MSIX).

Indicators of Compromise