Exposing FakeBat loader: distribution methods and adversary infrastructure
July 2, 2024, 9:28 a.m.
Tags
External References
Description
During the first semester of 2024, FakeBat (aka EugenLoader, PaykLoader) was one of the most widespread loaders using the drive-by download technique. Researchers uncovered multiple FakeBat distribution campaigns leveraging malvertising, software impersonation, fake web browser updates, and social engineering schemes on social networks to trick users into downloading the malware. Analysts monitored the FakeBat C2 infrastructure and identified over 130 domain names associated with high confidence to the FakeBat C2 servers since August 2023. The report provides IoCs, YARA rules and tracking heuristics to monitor the FakeBat distribution and C2 infrastructures.
Date
Published: July 2, 2024, 8:33 a.m.
Created: July 2, 2024, 8:33 a.m.
Modified: July 2, 2024, 9:28 a.m.
Indicators
loader_fakebat_powershell_fingerprint_may24
loader_fakebat_initial_powershell_may24
getmess.download
f3ebb23bdcc7ac016d958c1a057152636bc2372b3a059bf49675882f64105068
f8ab48848ab915d1b23e3ee51dd20a2699bd4f277bde218a727d7a55a572d174
f312e59be5ddbf857d92de506d55ae267800b0cbc2b82665ce63c889a7ae9414
f0f77c85c7da4391e34d106c4b5f671eb606ba695dc11401a6ee8ae53e337cbe
f138728ce2cc87201a51c9250fa87cbab20354012a8f566e1b2cd776cc1a66af
f1d72a27147c42a4f4baf3e10a6f03988c70546bb174a1025553a8319717ba95
f0e0aea32962a8a4aecd0c4b0329dc7e901fa5b103f0b03563cf9705d751bbe1
e3f18df1d8f5e27a41221246cc63236487c56354ba0c926a3fdaea70db901adb
e5b94c001fc3c1c1aa35c71a3d1e9909124339e0ade09f897b918fe0729c12e1
d1da457b0891b68df16ce86e2a48a799b9528c1631bccc379623551f873c0eed
d069437eda843bd7a675a1cca7fd4922803833f39265d951fa01e7ad8e662c60
c336d98d8d4810666ee4693e8c3a2a34191bad864d6b46e468a7eed36e7085f4
cea1c4f2229e7aa0167c07e22a3809f42ec931332da7cc28f7d14b9e702af66b
b5ed2f42359e809bf171183a444457c378355d07b414f5828e1e4f7b35bb505f
ae641dda420f2cf63ac29804f7009ba1c248c702679fbccef35e4d9319d77d2d
b7aa4697e16bbafe0df02ab3b8d0be8ec6e4abf6e6ca7d787d3d3684ca8f4b63
9e800a05e65efe923a35815157129652980f03cbcf95cf0d64676f6da73471de
aa998fde06a6a6ab37593c054333e192ce4706a14d210d8fc6c0de3fd2d74ce2
9aa39f017b50dcc2214ce472d3967721c676a7826030c2e34cb95c495dba4960
96bd6abb1c8ec2ede22b915a11b97c0cd44c1f5ed1cda8bee0acfee290f8f580
9a2268162982113c12d163b1377dc4e72c93f91e26bd511d16c1b705262ca03c
90641a72a4ea6f1fca57ec5e5daec4319ec95bec53dd2bf0fa58d1f9ade42ad4
904ce1b1ffa601f9aeb0a6d68bc83532c5e76b958029bd1c889937fa7cf1867f
8f88a86d57b93cd7f63dfdf3cb8cc398cdce358e683fb04e19b0d0ed73dd50ee
806d08e6169569eb1649b2d1f770ad30a01ff55beedfe93aebccac2bc24533c0
7d0aaf734f73c1cf93e53703e648125bba43e023203be9a938f270dfe3492718
7c7dc62ed7af2f90aeafdd5c3af5284c5539aeded7d642d39f5fd5f187d33c87
767dd301dc5297828a35eaba81f84bd0f50d61fe1a9208b8d89b5eaba064d65e
763bdd0b5413bb2e0e3c4a68a7542586bbd638665b7ca250dbd9c7558216e427
72a1f6e7979daae38d8e0e14893db4c182b8362acc5d721141ed328ed02c7e28
7316ed0cb0fdbede33a0b6d05d0be1fe3c616ef7c1098dfcc9a2339c793e7020
7265ffdbe31dd96d6e6c8ead5a56817c905ff012418546e2233b7dce22372630
6fb502d83b7b5181abcb53784270239cc3e4143344e1f64101537aa3848c8c95
6e0179344ca0bbc42dce77027f5a6a049844daf34595fd184d9f094e8c74325c
67663233f9e3763171afd3a44b769dc67a8a61d4a159f205003c5fdb150e2ca1
5ee273180702a54f32520be02c170ad154588893b63eefe2062cdb34ad83712c
5e5c134cea48e57da9604981c0a7fd6ef1704c4151b540f29de685e0017fa730
4e39fa74e49be2bf26fbfbbcea12d1374fa2f1607ff7fa2a0c8c323e697959ad
49a7668d60e8df9d0a57ba9e0e736c1eb48700da19711cc0ec0f3c94a56ce507
409a2a2a4e442017e6d647524fdec11507515a9f58a314e74307e67059bd8149
4029e194864e2557786e169c7f2c101b9972164de7b4f1ffadf89382317cf96c
400277618bd2591efb2eb22ac0041c1c5561d96c479a60924ef799de3e2d290c
3d3a9cd140972b7b8a01dde2e4cd9707913f2eba09a3742c72016fd073004951
3bd95eadb44349c7d88ea989501590fb3652ae27eded15ab5d12b17e2708969f
2e8a82f07de254848615f81272f08e0cf9af474d1c20f67d9ddbdf439f1d8fde
2b033fc28ad12cb57c7c691bd40911ca47dd2a8e495a2d253557d2c6bcd40c5e
1d5d671bf680d739ded1e25e78970b38d00e8182816171a7c6a186504a79eeee
1c5cadde01f10a730cd8f55633c967c3a7259f4906f961477b7e095e7db326b7
1bb51d62457f606e947a4e7ce86198e9956ae1fe4e51e4e945370cc25fe6bfff
175fcb7495c0814a5c18afa6244d467f0daeb0f02ad93c0ab4d3af8cbbacb537
12ea41f2dfa89ad86f082fdf80ca57f14cd8a8f27280aca4f18111758de96d15
0c4cef985c90ed764f041c2ccab6820fdbe38edaaddebe01a5b8d31d93204b88
088ed84658a7c3bef4401601ef67a6953492fb0200a3b580bfabb21cd3ac8236
020cd2e4ec27185550bf736b490d8ace0d244fe09315f9f7e18362de659bc7ad
07a0986ab43f717e181a32d6742b11f788403ce582ad5fcbb9d20d0bd40d410b
00ea5d43f2779a705856a824a3f8133cb100101e043cb670e49b163534b0c525
00e7e8a0e8495189bb7feca21864fbd6c61a5aa680462186504de02536e0c2f9
194.36.191.196
62.204.41.98
185.198.59.26
www.womansvitamin.com
https://utr-jopass.com/buy/
https://monkeybeta.com/build/AnyDesk-x86.msix
https://photoshop-adobe.shop/download/dwnl.php
https://getmess.download/Getmess.msix
https://brow-ser-update.top/download/dwnl.php
https://app.getmess.io/download/dwnl.php
https://brow-ser-update.top/GoogleChrome-x86.msix
https://app.getmess.io/
https://3010cars.top/?status=start&av=Names&domain=$domain&os=$urlEncodedOsCaption
https://amydlesk.com/download/dwnl.php
http://utd-corts.com/buy/
http://clk-info.site/?status=install
http://clk-info.site/?status=start&av=Windows%20Defender
notion.officespacesearchdc.com
notion.kyngsacademy.com
notion.ilusofficial.com
notion.findreaders.com
utr-provit.com
utr-krubz.com
utr-jopass.com
utr-gavlup.com
utm-msh.com
utm-fukap.com
utm-drmka.com
utm-advrez.com
utm-adsgoogle.com
utm-adschuk.com
utd-horipsy.com
utm-adrooz.com
utd-gochisu.com
utd-corts.com
utd-forts.com
usm-pontic.com
urd-apdaps.com
updaterdrivers.com
udr-offdips.com
trustdwnl.ru
trust-flare.ru
trust-flare.site
topttr.com
test-pn.site
test-pn.ru
rabby.pro
prkl-ads.site
prkl-ads.ru
photoshop-adobe.shop
notlon.top
notlilon.co
notliion.com
notiron.org
notiorn.org
notion.li
notion.help
notion-loads.com
notilon.co
notilion.co
noltlion.com
newtorpan.site
newtorpan.ru
new-prok.site
new-prok.ru
monkeybeta.com
infocdn-111.xyz
infocdn-111.site
infocdn-111.online
gotrustfear.site
gotrustfear.ru
getmess.io
ganalytics-api.com
fresh-prok.site
fresh-prok.ru
findreaders.com
dns-inform.top
cornbascet.site
cornbascet.ru
clk-info.site
clk-info.ru
clk-brood.top
clk-brood.online
clk-brom.site
clk-brom.ru
cdn-new-dwnl.ru
cdn-dwnld.site
cdn-dwnld.ru
cdn-ads.site
cdn-ads.ru
brow-ser-update.top
bienvenido.com
anydesk.best
amydlesk.com
aipanelnew.site
aipanelnew.ru
ads-work.xyz
advancedipscannerapp.com
ads-work.top
ads-work.site
ads-tooth.xyz
ads-strong.xyz
ads-strong.top
ads-strong.site
ads-star.xyz
ads-star.top
ads-star.site
ads-star.online
ads-moon.xyz
ads-moon.top
ads-info.ru
ads-info.site
ads-hoop.xyz
ads-hoop.top
ads-forget.top
ads-eagle.xyz
ads-eagle.top
ads-creep.xyz
ads-creep.top
ads-change.xyz
ads-change.top
ads-change.site
ads-change.online
ads-analyze.xyz
ads-analyze.site
ads-analyze.online
999-ads-info.top
98762341tdgi.xyz
98762341tdgi.top
98762341tdgi.site
98762341tdgi.online
875jhrfks.top
756-ads-info.xyz
756-ads-info.top
756-ads-info.site
465jsdlkd.top
364klhjsfsl.top
343-ads-info.top
3010offers.xyz
3010offers.top
3010offers.site
3010offers.online
3010cars.xyz
3010cars.top
3010cars.site
3010cars.online
2610kjhsda.xyz
2610kjhsda.top
2610kjhsda.site
2610kjhsda.online
2610asdkj.xyz
2610asdkj.top
2610asdkj.site
2610asdkj.online
2311forget.xyz
2311forget.online
2311forget.site
1212stars.top
1212stars.xyz
1212stars.site
1212stars.online
11234jkhfkujhs.xyz
11234jkhfkujhs.online
0909kses.top
0212top.top
0212top.xyz
0212top.site
0212top.online
puttyy.ca
pputy.com
ads-pill.xyz
ads-pill.top
ads-analyze.top
ads-strong.online
2311foreign.xyz
11234jkhfkujhs.top
11234jkhfkujhs.site
Attack Patterns
PaykLoader
EugenLoader
FakeBat
Eugenfest
T1568
T1193
T1064
T1189
T1071
T1192
T1140
T1195
T1566
T1133