Sponsored Adverts Spreading Malware Via Social Media Platforms

 Threat actors of late have started abusing sponsored ads on Facebook to deliver malware. Sponsored ads are advertisements that are paid for so that it reaches a wider user base. These posts are visible to all users even if they are not linked to the individual who posted the ad.

These are usually done to promote a new product or venture but can be used for other purposes too.

Why Facebook?

Facebook is one of the most popular social media platforms. Because of its vast user base, it makes it ideal for threat actors to use this platform to spread malware. Since these ads are sponsored by a trustworthy organization such as Facebook, threat actors can easily exploit unsuspecting users.

Since Facebook posts of an individual are typically viewed by followers or those who have liked the account, the sponsored posts feature allows threat actors to target even individuals who are not connected to the individual’s account thereby targeting a wider audience.

Recently one of our colleagues encountered a sponsored ad on Facebook, leading to a password-protected installer file, which our K7 Labs researchers confirmed as malicious.

Figure 1: Sponsored ad on Facebook delivering malware

Figure 2: Similar sponsored ad on Facebook delivering malware

The surprising part is how this seems authentic to Facebook in spite of an open password and Bard AI installation file being uploaded on the Facebook page.

Users need to be cautious and skeptical before clicking on any such ads so that they do not become a victim of such frauds. Users are requested to install a reputable security product such as “K7 Total Security” and keep it updated to stay protected from such threats.

Indicators of Compromise (IOCs)

File NameHashDetection NameChatGPT4_V1_setup.rar11003E86A94DD23DCE51AB723A3109F3Trojan ( 0001140e1 )Bard_AI_setup.rar0899ABACB1FF62EA61DDFD6A348C5713

Trojan ( 0001140e1 )

URLs

hxxps://trello[.]com/1/cards/6425453cf71a00f4324c4792/attachments/642545613c14f0aa0d1c5b5d/download/ChatGPT4_V1_setup.rar

hxxps://trello[.]com/1/cards/642461980f81d0cd9023035c/attachments/642461a59d404776028a3563/download/Bard_AI_setup.rar


Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

Ransomed by Warlock Dark Army “OFFICIALS”

  Recently we came across a tweet shared by petikvx . The tweet was on a ransomware family that had the group name similar to the WARLOCK DARK ARMY. The similarities with Chaos ransomware seem to end with the attacker group’s name. Upon analyzing the ransomware from the tweet we suspect both to be very different groups just based on their malware’s attributes. The sample under consideration was compiled using C/C++, in case of Chaos ransomware it is usually .Net. Statically looking at the file we noticed a resource entry under Bitmap with an identifier “14”, while analyzing the file code we noticed that this resource was read and loaded on to the memory. Hence we decided to dump that resource entry. Figure 1: Encrypted blob in resource section Figure 2 : Loading blob into the memory During our code analysis we found this blob was XOR encrypted. The first 16 bytes of this blob acts as the key for XOR decryption and the rest is the data which plays a key role in this ransomware’s in...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more