The research team has been analyzing a series of info-stealing malware, and they have recently come across an interesting campaign involving the PHP version of Ducktail Infostealer. This malware is being actively distributed by disguising itself as a free or cracked application installer for popular software, including games, Microsoft Office applications, and Telegram. Ducktail Infostealer, attributed to a Vietnamese threat group, has been active since 2021 and has primarily targeted Facebook Business accounts to manipulate pages and gain access to financial information.

The Ducktail Infostealer instances were first identified in late 2021. In July 2022, researchers observed that the threat actors specifically targeted higher-level employees with access to Facebook Business accounts to steal data and take control of the accounts. The earlier versions of Ducktail were based on a binary written in .NET Core and utilized Telegram as its command and control (C2) channel for exfiltrating data. However, in August 2022, a new campaign involving a PHP version of Ducktail Infostealer with new tactics, techniques, and procedures (TTPs) was observed.

According to an analysis, the threat actors have shifted their focus from targeting specific employees with administrative or financial access to Facebook Business accounts to a broader audience. The malicious executable files are typically in .ZIP format and are hosted on file-sharing platforms, posing as cracked or free versions of popular applications like Office, games, subtitles, and explicit content files. Compared to previous campaigns, changes have been made in the execution of the malicious code. The threat actors now employ a scripting version where the main stealer code is a PHP script instead of a .NET binary.

The execution flow begins with a fake installer that generates a temporary file, which then re-initiates the installer with a "/Silent" parameter. Another temporary file is created, which drops all the supporting files and malicious files at a specific location on the victim's machine. To achieve persistence, a series of events take place, scheduling tasks to execute the malicious payload, named "libbridged.exe," daily and at regular intervals.

The stealing of data and its exfiltration are achieved by decrypting the stealer code at runtime in memory. The PHP script performs various actions, such as fetching browser information, extracting stored browser cookies, targeting Facebook Business accounts, searching for cryptocurrency account information in the wallet.dat file, and sending the collected data to the command and control (C&C) server.

The PHP script creates PHP associative arrays to prepare for data transmission to the C&C server. The CURL command is used for sending and receiving files over HTTP, and specific switches are employed during communication.

The script also collects information about installed browsers, retrieves data from the local state file in the Chrome user data directory, decodes sensitive data protected by Chrome's local data encryption, encodes stolen information to base64, and saves it to log files. It specifically targets Facebook pages, including Facebook API graph, Facebook Ads Manager, and Facebook Business accounts, to gather account details, payment cycles, account statuses, funding sources, and other relevant information.

After completing the data-stealing activities, the PHP script connects to the C&C server to obtain a list of targeted folders and URLs stored in JSON format, which are then used to gather further information. The stolen data is sent to the C&C server in JSON format.

To conclude, the threat actors behind the Ducktail Infostealer campaign are continuously evolving their delivery mechanisms and tactics to steal a wide range of sensitive user and system information, particularly targeting Facebook Business accounts.

Impact

• Sensitive Information Theft
• Credential Theft

Indicators of Compromise

Domain Name

• deolahuman.shop

MD5

• f7b9e82313fa4ae0fae15a7439c93b51
• 5bc587ba29d29bd546f5d9db8add0cac
• 34a51f293b7de9f0d10a992d79cc7db7
• aab784d282206ce55e78d2f1d59a5bf3
• 373a5903f9ca2d8726c2ddd7086b80f5
• 6dda614ac4b7397eebfb78d86de3022a
• 48d121bf941b5180ab30b9ffdffb8c72
• eb4f2afc3170c3355323669b2bd393f4
• 7bf58d5fce0d1080f0b2197c97e49c55
• e5dd10cefa0c947a6fdef31631c832b3
• 29171aa5a08b8e063ee6f2258760c477
• 2985f6137285133061938747dd0f28b0
• febf0622e8b490eb0ae2fbd81e8f357c
• be13e544fcb806f14dd2b8222985ebcc

SHA-256

• d87743ffbc425ff382de466d1d32608f9c613a83555acf1dc2123898eddc6eb4
• 59280bac3395cdcc803d2980a822f7b4b4b8021a7289dcfc523df9a07c0f0fc0
• a6e80367c8fa6eb8b7d3a2f5841d238fa1e001c4945dd816acf9379a27488973
• a7d53d74358ed864a58c3c9e1c0a27b7d42241139c3617e558025b9890daa2d7
• fb5e12ff089beb0bf0d196014bd3566dde30d7ab49a4d6f49b5653bfab254827
• 657ad1c28f3a05d59635e5cc123670f5d2f5eed906b0bcbebcbfa96d4bc62209
• 1f41a14b309a0fe1757dcf00f01c9c6bf3a2ce77ad829f2e3064826cea468eae
• 2baf4fd1add6428bb14540fecab023542ed4a22d43c5ac9e7715ebfc2eec80fb
• c099010f6d191149932335b042a466ce12b319762e84598ad3c7567359213c87
• 8495819368d0b7e8f6ef97ddd9465bf7d6dfab6bef2e476d6c61b0ea5ed90826
• 64a159b1294122a9d074205ee9144d65310f237b3e507abcf7a74a69ff36d6ef
• 6d081575fc6c9bc2076d3b4d745d3f40c25c515bc534517fd8e9060485e0f9b6
• d68f101fd08a0431a95a11152964e813574ac2a00c3d83a30493f94b31c4a613
• e598fc7f2a86619741d6cb3bb3eaa53d4a14d325197f8120d04e767c70f82e82

SHA-1

• 8a2eb926106efc308c77df45a80c7d4641b04d07
• 4b20b726fe051b535868d22f80abc5835741a64b
• 174e9c5ba874bad46e63c2b413b83914e7fcb452
• 8131923b8f7b6f49e895a117dec191ea2653297a
• 1f036e8bbd24740877aca1a1e9408b5f853793d2
• ea301142451ba3e9afc44762e37849de60ece009
• 8c9446f1188a8d583429d5f85380e12e325cfb53
• d543e00afb026aec32bdd71b6e899bf610d9cf18
• d165bb9127b43f01d2f78452bf223149d33a1cd5
• 728151e5bdfb6cdf46a5356f35b5c23bcb9c9301
• e35c29436228de962d83f90f73cdba210fcce635
• 5f244b70d087c611c4521fcf76f666514c2200a2
• 97ae79508c9a116f262bba445308f10f5a21ab51
• 4ddd912010ffaf1556afbf3852a290bdfc839202

Remediation

• Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Enabling two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
• Regularly backing up your important data can help ensure you don't lose any critical information in the event of a malware infection or other data loss event.
• Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
• Make sure all of your software, including your operating system and applications, is up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by info-stealers and other types of malware.
• Promptly apply security patches and updates for operating systems, software applications, and browsers. This helps to address vulnerabilities that threat actors may exploit to deliver malware.
• Utilize web filtering solutions and URL reputation services to block access to known malicious websites and prevent users from visiting potentially dangerous links, such as those used in Ducktail infostealer campaigns.
• Implement network segmentation to restrict access and isolate critical systems, such as those hosting sensitive financial information or Facebook Business accounts. This prevents lateral movement of malware and limits the impact of a potential compromise.
• Implement robust monitoring solutions to detect any unusual or suspicious activities, such as unauthorized access attempts or data exfiltration. Establish an effective incident response plan to quickly respond to and mitigate any potential breaches.
• Maintain regular backups of critical data, including Facebook Business account information, and ensure they are stored securely offline. This enables quick recovery in case of a successful attack or data loss.