Researchers from ANY RUN have uncovered a malware distribution scheme named DeerStealer, which exploits misleading websites posing as genuine Google Authenticator download pages.
The first fraudulent site identified, “authentificcatorgoolglte[.]com,” is designed to closely mimic the legitimate Google page “safety.google/intl/en_my/cybersecurity-advancements,” likely aiming to deceive users into thinking it’s a trustworthy source for the application. When users click the “Download” button on this imposter site, it performs two malicious actions: it first sends the visitor’s IP address and geographical information to a Telegram bot, potentially for tracking and victim identification purposes.
Secondly, rather than providing the genuine Google Authenticator app, the site redirects users to a malicious file hosted on GitHub under the repository “github[.]com/ggle24/ggle2.” This file is believed to contain the DeerStealer malware, disguised as a legitimate app. Once downloaded and executed, DeerStealer can clandestinely steal sensitive information from users.
On June 19, 2024, a user known as “fedor_emeliyanenko_bog” initiated the Telegram bot Tuc-tuc, which began logging messages that revealed the source site and allowed for the extraction of active phishing sites linked to this operation. Through the analysis of chat histories, researchers have compiled a list of domains associated with these phishing attacks.
The DeerStealer, originating from GitHub, is a Delphi-based malware with a payload delivered via a Reedcode-signed file. This file uses obfuscation techniques to hide its actions, including API calls wrapped in functions that fetch addresses from global variables and use JMP RAX for execution. Further obfuscation is achieved through numerous obscured constants within the code, complicating analysis. The malware operates directly in memory, avoiding the creation of persistent files on the system.
The sample analyzed by ANY.RUN demonstrates characteristics of a potential client connecting to a Command and Control (C2) server. The sample initiates contact by sending a POST request with the device’s hardware ID (HWID) to the domain “paradiso4.fun,” likely for authentication or registration purposes. Following the server’s response, the sample sends additional one-way POST requests, indicating possible data exfiltration or reporting functions to the C2 server.
The data sent shows a high frequency of the byte 0xC, suggesting the use of single-byte XOR encryption with a key of 0xC, given XOR’s properties with zero. Decrypting with CyberChef reveals PKZip archives containing system information such as hostnames, processor details, and active processes, confirming the encryption method and hinting at potential data exfiltration or system monitoring activities.
Researchers have identified a YARA rule that matches a DeerStealer sample and found two similar samples related to the XFiles malware family. Both use the strategy of distributing through fake legitimate software sites. While DeerStealer is a compiled machine-code application, XFiles is a .NET-based malware that uses staged C2 communication, sending HWID first before any data transfer, unlike XFiles’ single POST request.
Indicators of Compromise (IOCs):
- 4640d425d8d43a95e903d759183993a87bafcb9816850efe57ccfca4ace889ec
- 569ac32f692253b8ab7f411fec83f31ed1f7be40ac5c4027f41a58073fef8d7d
- 5e2839553458547a92fff7348862063b30510e805a550e02d94a89bd8fd0768d
- 66282239297c60bad7eeae274e8a2916ce95afeb932d3be64bb615ea2be1e07a
- a6f6175998e96fcecad5f9b3746db5ced144ae97c017ad98b2caa9d0be8a3cb5
- b116c1e0f92dca485565d5f7f3b572d7f01724062320597733b9dbf6dd84dee1
- b5ab21ddb7cb5bfbedee68296a3d98f687e9acd8ebcc4539f7fd234197de2227
- cb08d8a7bca589704d20b421768ad01f7c38be0c3ea11b4b77777e6d0b5e5956
- d9db8cdef549e4ad0e33754d589a4c299e7082c3a0b5efdee1a0218a0a1bf1ee
- E24c311a64f57fd16ffc98f339d5d537c16851dc54d7bb3db8778c26ccb5f2d1
