Rewterz Threat Alert – Fashion Industry Professionals Targeted by Ducktail Malware’s Newest Campaign – Active IOCs

Severity

High

Analysis Summary

Ducktail’s latest campaign focuses on targeting marketing professionals within the fashion industry, in which the attackers distribute archives that contain several images of real products from known brands, but it comes alongside a malicious executable disguised as a PDF file.

When the malware is executed, it opens a genuine embedded PDF that has details on job information, specially crafted to appeal to the marketing professionals who are actively searching for new jobs. The malware’s goal is to install a browser extension that is capable of stealing Facebook business and ad accounts, and later sell the stolen credentials to third parties.

After the victim opens the malicious file, it downloads a PowerShell script (param.ps1) and a fake PDF file into the compromised device’s public directory. The script is triggered by the default PDF viewer to open the fake PDF which then shuts down the Chrome browser.

At the same time, a couple of malicious browser extension files are installed on a Google Chrome directory and pretend to be a Google Docs Offline extension. The main hidden script continuously sends details of which tabs are open on the browser to a C2 server.

When any Facebook-related URLs are detected, the extension tries to extract cookies and account details to steal business and ad accounts. The extension is also capable of bypassing the two-factor authentication (2FA) by using Facebook API requests and a service from Vietnam called 2fa[.]live. All stolen credentials are transferred to a C2 server based in Vietnam.

“An important feature that sets it apart is that, unlike previous campaigns, which relied on .NET applications, this one used Delphi as the programming language”, according to the researchers.

The campaign’s use of the Delphi programming language makes it difficult to detect by cybersecurity teams since the language’s uncommon signature-based antivirus protections might not be able to see it.

Ducktail has shown to be a persistent threat and has been active since at least May 2021. It has affected users with Facebook business accounts in the United States and many other countries. The operators of Ducktail have constantly shown how adaptable their attack strategies can be.

In addition to using LinkedIn for spear-phishing targets, the malware group has also started utilizing WhatsApp. Cybersecurity analysts have discovered a connection between the recently-rising DarkGate remote access trojan (RAT) and Ducktail due to the similarity in their methods.

To improve their monitoring, organizations are recommended to employ more behavior-based analytics in order to identify anomalies that indicate malicious activity. Marketing teams in particular should be offered training for noticing social engineering, as these attacks are mainly targeting them.

Impact

• Sensitive Information Theft
• Credential Theft

Indicators of Compromise

MD5

• c50b7dd6fe4225df984409a507eb8cba
• c8c598f4a00c442f3bc7ab944fd601df
• 9a55cc71fdbf468d6fa0ff9e85d5c175
• 3b4263545e0bba6fde5993ffa65ec23a
• 017f6cfa19aa01380c32e3ef0ece27bc
• 570b64e953bc1263ac2f005f53569ac0
• 72f0c57264a8f1648b489103fe0f3b57
• 7a9c8a203531141d7969508545206afa
• 14cbd4148bbfa2a76ca049bfff28e815
• dfe5ce49d061c1655d4285810d032586

SHA-256

• c82b959d43789d3dbf5115629c3c01fa8dd599fbec36df0f4bc5d0371296545a
• 2b3decf08bf9223fb3e3057b5a477d35e62c0b5795a883ceaa9555ca7c28252f
• 69257876e2ec5bdbe7114d6ce209f13afbfddb2af0006a6d17e6e91578966870
• da13db80b0f3c25b512a1692494f303eff1ff1778a837208f79e2f3c81f8192e
• bde696a0ae901864716320e3111d5aa49cba3b1d9375dce2903f7433a287b2f2
• 04dd228d0b088c4116b503c31de22c1746054226a533286bec3a3d0606d73119
• 89f016d32707f096cc8daf674e5a9fc2ba6cf731d610f5303d997fc848645788
• 7da7ca7fcbc6e8bc22b420f82ae5756ecd3ad094b8ebcbd5a78a2362eb87b226
• 655a8ea3bc1baff01639dcdc43a294f8a5dc622e543d8f51e9d51c6eaaae6f6e
• 1117a93b4b4b78e4d5d6bd79f5f0e04926759558218df30e868464f05bf1bd3d

SHA-1

• 73b9f70ce4535e05555f4865553a7de96d0b6f7e
• 6151c76874f5a1e14d82ec083fe5ae28b0c6dd98
• 10ff9df05ff652c5e4665faff9c2f8e8d12c7474
• 28dd7acf5c254a445cca1bb46d967a9b1c1bcbdb
• 5216dc54a8a481d05810a4f1434c1924d379d07b
• a513bc9942e610058a3b261600ad25d9d3521d29
• f34b4f24070697d477e19999063f72e4a10e7f8a
• f791ef52bb0941caca728a69c668b1181aeff311
• 6eff35b64dbd51205a96478378cfc673106ec37e
• 6cfff59f20078b21689e1477faa59836b5351c7c

Domain Name

• dauhetdau.com
• motdanvoi20232023.com
• voiconprivatesv2083.com
• cavoisatthu2023asd.com

Remediation

• Block all threat indicators at your respective controls. Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Enable two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
• Regularly backing up your important data can help ensure that you don’t lose any critical information in the event of a malware infection or other data loss event.
• Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
• Make sure all of your software, including your operating system and applications, are up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by info-stealers and other types of malware.
• Promptly apply security patches and updates for operating systems, software applications, and browsers. This helps to address vulnerabilities that threat actors may exploit to deliver malware.
• Utilize web filtering solutions and URL reputation services to block access to known malicious websites and prevent users from visiting potentially dangerous links, such as those used in Ducktail infostealer campaigns.
• Implement network segmentation to restrict access and isolate critical systems, such as those hosting sensitive financial information or Social media accounts. This prevents lateral movement of malware and limits the impact of a potential compromise.
• Implement robust monitoring solutions to detect any unusual or suspicious activities, such as unauthorized access attempts or data exfiltration. Establish an effective incident response plan to quickly respond to and mitigate any potential breaches.
• Maintain regular backups of critical data, including social media accounts like Whatsapp, Facebook Business account information, and ensure they are stored securely offline. This enables quick recovery in case of a successful attack or data loss.