Rewterz Threat Alert – New NodeStealer Variant Targeting Facebook Business Accounts and Crypto Wallets – Active IOCs

Severity

High

Analysis Summary

Cybersecurity researchers discovered a Python variant of a malware called NodeStealer, which has been actively targeting Facebook business accounts and cryptocurrency wallets in a phishing campaign since December 2022. The NodeStealer malware is designed to steal browser cookies, allowing it to hijack accounts on various platforms, including Facebook, Gmail, and Outlook.

“NodeStealer poses great risk for both individuals and organizations. Besides the direct impact on Facebook business accounts, which is mainly financial, the malware also steals credentials from browsers, which can be used for further attacks.”

The malware was first identified in late January 2023, specifically targeting browsers on Windows systems, but it can also affect popular web browsers such as Google Chrome, Microsoft Edge, Brave, and Opera. The variant disclosed by Meta (Facebook’s parent company) in May was a custom JavaScript malware bundled with the Node.js environment, enabling it to execute on different operating systems, including Windows, Linux, and macOS. It is believed to originate from Vietnam, distributed by threat actors from the same region.

The phishing campaign employed by the threat actors involved sending messages that contained download links to a .zip archive hosted on well-known cloud file storage providers like Google Drive. This .zip file contained the malicious NodeStealer executable.

Two variants of the Python-based NodeStealer were identified. The first variant could steal Facebook business account information, download additional malware, disable Windows Defender via GUI, and steal funds from the MetaMask cryptocurrency wallet by using stolen credentials from various web browsers.

The second variant had additional features, such as parsing emails from Microsoft Outlook, exfiltrating data via Telegram, taking full control of the Facebook account, and possessing anti-analysis capabilities. These enhancements were likely aimed at increasing potential profits for the threat actors.

comparison of NodeStealer with its two variants

Upon execution, the NodeStealer malware checked if a Facebook business account was logged in on the infected machine and, if found, connected to the Graph API with stolen user ID and access tokens to extract information about the target, including followers count, verification status, account credit balance, prepaid status, and ads information.

NodeStealer is part of a rising trend among Vietnamese threat actors, similar to malware such as Ducktail. These actors are increasingly targeting Facebook business accounts for advertising fraud and spreading malware to other users on the social media platform.

The report emphasizes that NodeStealer poses a significant threat to both individuals and organizations, as it can steal credentials from web browsers, enabling further attacks. The potential damage could extend to financial loss and reputation damage for the targeted entities.

The continuous development and sophistication of NodeStealer variants underscore the importance of remaining vigilant against such cyber threats.

“Facebook business account owners are encouraged to use strong passwords and enable multi factor authentication. Take the time to provide education for your organization on phishing tactics, especially modern, targeted approaches that play off current events, business needs and other appealing topics”, they conclude

Impact

• Sensitive Information Theft
• Accounts Takeover
• Financial Loss
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 623042b57f5510b5f300e5bec46c51e2
• 37fcb644dd588a5683249e7db7d03b40
• f389693ff4e9863b712e80314bf4a6a8
• a24a56622341bb722a0cffec3effd85b
• ed0fe734a63699d3fbf42f6251e4697a
• 2d62aa427512ed47755fdf5749fe90a5
• f160da34e4b707870c9e82007f062bf5
• 6c4360a9e1b23995675a8599d70aa443
• c704c8a5400f353e4f232211ddedb0a3
• 8d41f5eaac4acca0d1d675b28da1df58
• 490693860a69fb031bea7b20749adf15
• f96842ca672f1672187963ca93adb898
• 319bc0b98430d630a64a36a29e7cece9

SHA-256

• 3fff146c3e50a7ddc7e446ae51742c59c3d3277931f3c511d9651497e4ab14a7
• f61403729e3f4e212411db486a537eabca2d0b84be21b789cddca4fc3aa85923
• a8adea800186dd52173dc6e55c46aa0b3619bef3eee25b17b7edba9353d5d08e
• a6509563be7a8569e05198858658b8934d7bc5ad3d41e9806e261995c99a6acf
• 6d12c657ee403272cb3115fd0a6cf1ffe69cd4476c5a03bbc13c624ddd153518
• e856cc78ce1603547bb6fdb3eb9da137f671e9547c072abea63b0248ec82ecb1
• 1998492619c1fc6a5b78d5c4c6beb05c582a1be6ad2b9ac734179c731bbcf5cc
• 44dabadbf099bdb28fdc4d86cebe53c00085c9c2ad52df4d4774320409e7358b
• fa5b9b72f248e1f79b3a424b61a1bcce8bf6a99452545cfe15d7211f3eb3e93b
• 001f9d34e694a3d6e301a4e660f2d96bc5d6aa6898f34d441886c6f9160d9e48
• 9a551426cbb2cd7aded923f277eec195a282913d51c41f1791683e03a85379e0
• a8608b8537338659943802bd4c3f37465b6b7146c60088e890f1201452690510
• f08394c78f40c3028156c78672d1a8030c64a9f292b1fbb4bd42437381c96a54

SHA-1

• e86f3204cf919db10e6fa1609fb535e440d23bb5
• 95b5957f1afc5ad1ecb186e9591ff4ded7c74be1
• f1eb1e9c049a46c8d96bb44de7ecf80edfa64d04
• 1073eb6d1bfac659139ae131756d7e526bdc830c
• a6d0ebb31bf23b00696232a90ab3853aefb380f3
• b7476393290121318b95cc35783c6e3cc183e170
• 6deb330eca4573c8f260065c6ea61adfb2b40012
• ed491981e88c7b349e056f6fc8d0c6d6709ad96d
• 8dd99a08c5991ebe8511fc3543df98c5a11e676a
• fae9ae27839a58084fc4b2d528631e0446afc73e
• b1c9b1f39c2af12b9eee533f04f12c5d4816e65e
• da5bc554e66905c9c63d1dbd8b5f97854239227b
• 981896f72353def9cf649f7075338b68b85d15d2

URL

• https://tinyurl.com/batkyc
• http://adgowin66.site/ratkyc/4/bat.zip
• http://adgowin66.site/ratkyc/4/ratkyc.zip

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Never trust or open links and attachments received from unknown sources/senders.
• Enable MFA for all accounts, including Facebook business accounts and cryptocurrency wallets.
• Keep all software, including operating systems, browsers, and security tools, up to date with the latest patches and updates. Vulnerabilities in outdated software can be exploited by malware like NodeStealer.
• Enforce a strong password policy for all accounts and systems. Encourage users to create complex passwords that include a mix of uppercase and lowercase letters, numbers, and special characters.
• Employ intrusion detection and prevention systems to monitor network traffic for any suspicious activities or attempts at unauthorized access. Regularly analyze logs and traffic patterns for signs of compromise.
• Use email security solutions to block phishing emails and malicious attachments.
• Utilize advanced endpoint protection solutions that can detect and block the execution of malicious files, including NodeStealer and other variants.
• Regularly back up critical data and store it securely offline or on a separate network.
• Train employees on recognizing social engineering techniques used in phishing campaigns. Encourage them to report any suspicious activities immediately.