When setting up a new PC, many of us have go-to software packages we like to install. But if you’re not careful, you might end up installing malware masquerading as your favorite software. Since November last year, we have noticed an uptick in campaigns using malvertising to deliver malware to unsuspecting victims. Our latest Threat Insights Report found that malware downloaded from the web was the second most popular delivery vector behind email. Attackers use various techniques to lure users to malicious websites where the malware is downloaded. With malvertising, malicious actors buy advertisements in search engine results, redirecting users to websites hosting malware. This article summarizes current malvertising campaigns and shows how they work. We analyzed two major malware campaigns delivering Vidar Stealer and IcedID, both of which use malvertising and imitate well-known software. We have also seen other families distributed using this method, including BatLoader and Rhadamanthys Stealer, indicating the growing popularity of this delivery mechanism among threat actors.

Vidar Stealer Malvertising Campaign

The first malware campaign we analyzed has been active since the end of November 2022. The attackers lure their victims through search engine advertisements that mimic popular software projects. Buying adverts enable attackers to achieve a higher search engine ranking for their malicious websites for software-related queries. In this case, the attackers imitated Audacity, Blender and GIMP. User who search for one of these software packages may be served an advert depending on its configuration. Clicking the advert leads to a malicious website.

Figure 1 – Advert leading to a website hosting Vidar Stealer malware

Looking closely, you’ll notice the malicious advert’s domain name differs from the software project’s genuine website. But the difference between the domains is subtle and easily missed. Clicking the advert leads to a fake website that copies the design of the legitimate Audacity website.

Figure 2 – Website mimicking Audacity used to spread Vidar Stealer

The fake website looks almost identical to the real one, making it hard for the user to spot that it’s fake. When the user clicks on the download button, an .exe file masquerading as an installer is served, in this case, “audacity-win-x64.exe”.

Examining the Downloaded Executable

The downloaded file is not the real software installer but malware. The file is a whopping 343MB, which is unusual for malware. There are several reasons why the attackers may have artificially inflated the file. First, a larger file size is more likely for a software installer. Secondly, and more importantly, extremely large file sizes can be used to bypass the automatic scanning of some antivirus software.

Figure 3 – Vidar Stealer 0x00 byte padding

To artificially inflate the file, the attackers added a long 0x00 byte sequence to the end. Removing this sequence results in a file size of about 500KB, which is suspiciously small for a software installer.

Figure 4 – Vidar Stealer download redirections

The malicious file is not hosted on the fake website but on the 4sync.com file-sharing service. So far, all the fake installers in this malware campaign have been hosted on this service. A detection opportunity is to look for traffic to this website and consider blocking access to stop users from inadvertently downloading the malware.

This campaign distributes Vidar Stealer, an information stealer capable of exfiltrating passwords, cryptocurrency wallets and information from two-factor authentication software. The malware relies on a static configuration that includes its version, botnet ID and one or more URLs that contain command and control (C2) details. The configuration of this specific campaign looks as follows:

Figure 5 – Vidar Stealer configuration

Vidar Stealer uses popular online services, such as Telegram and Steam Community, to hide the C2 information. If we go to this website, we will find the real C2 URLs.

Figure 6 – Vidar Stealer C2 hidden on well-known online services

Vidar uses this information to download a dynamic configuration from the C2 server.

Figure 7 – Vidar Stealer dynamic configuration

This configuration defines which stealer functionalities should be enabled. The malware downloads a file named “update.zip” from the C2 server to support these features. This archive contains several DLL files that Vidar uses to extract credentials from applications on the infected PC. After extracting the information, the malware exfiltrates the credentials through an HTTP POST request to the C2 server. The server confirms the receipt with an “ok” response.

Other Mimicked Software Leading to Vidar Stealer

The attackers distributing Vidar Stealer have mimicked other software projects besides Audacity, including Blender and GIMP. For example, searching for “blender 3d” leads to the following search results:

Figure 8 – Advert leading to a website hosting Vidar Stealer malware

As before, the adverts appear at the top of the search results and lead to a website mimicking the legitimate Blender website. Clicking the download button serves Vidar Stealer. The campaigns are generally structured in the same way. The attackers buy adverts for specific keywords and customize the landing page by copying the website design of a popular software project.

Figure 9 – Fake software websites delivering Vidar Stealer

The domains used in those campaigns are always very similar to the legitimate domains of the software projects, differing only by a few characters. This technique is called typosquatting. When expanding our search for domains based on this pattern, we discovered other domains that could be linked to this campaign.

Figure 10 – Possible typosquatted domains

We can repeat the process for the other imitated software projects, revealing more domains that may be linked to this campaign.

Figure 11 – More possible typosquatted domains

More Infostealer Families and IcedID Spread Using Fake Software Malvertising

Vidar Stealer isn’t the only family being distributed through malvertising. We have also seen this fake software malvertising theme used to spread infostealers such as Rhadamanthys Stealer and BatLoader.

Figure 12 – Fake Notepad++ website leading to Rhadamanthys Stealer

However, since mid-November, the largest campaigns we’ve seen using this delivery approach are those spreading the IcedID trojan.

Figure 13 – Fake Microsoft teams website leading to IcedID

Here a .zip archive is downloaded from a mimicked software vendor’s website, containing an MSI file.

6b4239bdb1080b21570feba7058d87b35e18bc74c20c68611c2012002b8a0aa3 ./Setup_Win_03-01-2023_08-37-05.msi
30fc78d96fc1814753b38958207e80727e9fd9b016ab951c93a3ddddfc643731 ./Setup_Win_03-01-2023_08-37-05.zip

Since MSI files are commonly used to install software, this file format is familiar to users and unlikely to raise suspicion. In all the IcedID campaigns we’ve seen, the .zip archive is hosted on Google Firebase, an application hosting service.

hxxps://firebasestorage.googleapis[.]com/v0/b/composed-anvil-370809.appspot.com/o/f6lRfSavTD%2FSetup_Win_03-01-2023_08-37-05.zip?alt=media&token=6a578eb6-d723-4f6b-9cf9-f2575dc56ccb

Since this API is widely used, this network traffic may not raise flags in a corporate network, making the attack even more dangerous. When the MSI file is executed, the “installation process” of IcedID starts. Typically, this begins with an MSI file that launches the msiexec.exe process. Further down in the process chain rundll32.exe is started with a DLL file as an argument. Despite the malware being a DLL, the file does not use the .dll file extension. In this case, the attackers named the sample with a .msi extension. Since the file extension does not matter when running rundll32.exe, the specified function of the DLL is started, and the IcedID downloader is executed. Next, the IcedID downloader communicates with the configured C2 server and finally downloads the IcedID bot.

IcedID Distributors Imitate Other Software Vendors

As with Vidar Stealer, the attackers imitate the legitimate websites of software projects to spread malware. The attackers tend not to vary the domains’ properties across campaigns, making it possible to identify the fake websites based on their domain registrar, name servers and domain names.

Figure 14 – IcedID download domains imitating well-known software products

Over about two months, our search identified 92 domains that mimic many different software vendors that have been or could still be used to distribute IcedID. These domains are listed below.

Conclusion

In the last two months, we’ve seen a significant increase in malware distributed through malvertising, with multiple threat actors currently using this technique. Attackers are imitating the websites of popular software projects to trick victims into infecting their computers and buying search engine adverts to drive traffic there. The fake domains closely resemble the legitimate ones, making it difficult to recognize the adverts as malicious. By looking at the characteristics of the domains used to spread Vidar Stealer and IcedID, we were able to discern a pattern, enabling other potentially malicious websites to be identified. In total, we found 92 typosquatted domains likely related to the IcedID campaign, indicating the growing popularity of this delivery mechanism among threat actors.

Indicators of Compromise (IOCs)

Vidar Stealer fake software domains:
qiupm[.]org
audacite[.]org
blenderon[.]org

Vidar Stealer download URLs:
hxxps://qiupm[.]org/download.php
hxxps://dc437[.]4sync[.]com/download/v7CZw0ei/gimp-21032-setup-x64.exe?bip=OTkuMjM4LjkuNDk&dsid=g1EIcGR7.320a1832a2afc6402a552d4541a2a6b3&lgfp=71&sbsr=fe7711589983b964b3dc65e35696ba56acb

hxxps://audacite[.]org/download.php
hxxps://dc708[.]4sync[.]com/download/ylj1Atf5/audacity-win-x64.exe?bip=OTkuMTkyLjkuNjU&dsid=RKIC-eQk.f80c69d7e6b86e7f78797d6bdc9506ab&lgfp=71&sbsr=3fc65ec0ec5fe54a660f780d6cbf726bacb

hxxps://blenderon[.]org/download.php
hxxps://dc538[.]4sync[.]com/download/OLHybl-Y/Blender3D.exe?bip=NzMuNjguMjA0LjY3&dsid=BjPEPMAL.8176fccb006e7d79514c598c39b98cec&lgfp=71&sbsr=69f07b9802e4dc9deb8baf6a3185fb6dacb

Vidar Stealer:
b47bf25df7853a395d1d98680b19c9cfca78ec7f58e3d577db100e08701404ae 070144aecbba81db2935c67f2e70a15e67893339cb8709d243c7b615887d2b01

Vidar Stealer C2:
hxxp://95.216.207[.]27/1819
hxxp://95.216.207[.]27/update.zip

IcedID fake software domains:

wvw-irs-forms[.]top
vvv-discord[.]top
mlcrosofteams[.]top
wvvw-citrix[.]top
wvw-adobe[.]top
vwvv-discord[.]top
www-microsofteams[.]top
vwv-discord[.]top
www-onenote[.]top
www-microsoftteams[.]top
www-llbreofflce[.]top
wwv-slack[.]top
wwv-discord[.]top
wvw-discord[.]top
microsofteams[.]top
wwww-irs-form[.]top
wwww-teamvlewer[.]top
wwww-slack[.]top
wwww-citrix[.]top
www-lbreofflce[.]top
www-adobecom[.]top
www-anydeskcom[.]top
www-discordc[.]top
microsoftteams[.]top
wwww-irs-forms[.]top
wwwwslack[.]top
wwwwanydesk[.]top
wwww-dlscordcom[.]top
wwww-adobe[.]top
www-thunderblrd[.]top
www-teamvlewer[.]top
www-libreofflce[.]top
www-irs-forms[.]top
www-fortlnet[.]top
webeex[.]top
sandboxieplus[.]top
www-docker[.]top
www-citrix[.]top
www-realvnc[.]top
microsoft-teams[.]top
www-basecamp[.]top
wwwwadobe[.]top
irs-forms[.]top
wwwadobe[.]top
llbreofflce[.]top
wwwchase[.]top
wwww-discordcom[.]top
wwwteamviewer[.]top
wwwslack[.]top
wwwfortlnet[.]top
wwwebex[.]top
thunderblrd[.]top
wwww-anydesk[.]top
wwwanydesk[.]top
www-chase[.]top
www-anydesk[.]top
wwwvmware[.]top
sandboxie-plus[.]top
www-obsproject[.]top
www-teamviewer[.]top
www-slack[.]top
www-adobe[.]top
fortlnet[.]top
irsform[.]top
wwwwebex[.]top
wwwfortinet[.]top
www-whatsapp[.]top
www-discordcom[.]top
wwwdiscordcom[.]top
www-torproject[.]top
dlscordcom[.]top
torproject[.]top
cryptobrowser[.]top
discordcom[.]top
irsforms[.]top
llbreoffice[.]top
irsgov[.]top
thunderbird[.]top
postbox-inc[.]top
wwww-dlscord[.]top
wwww-discord[.]top
wwwwdiscord[.]top
www-fortinet[.]top
www-ringcentral[.]top
www-webex[.]top
www-goto[.]top
www-vmware[.]top
www-brave[.]top
www-discord[.]top
www-irs[.]top
www-dlscord[.]top

IcedID download URL:
hxxps://firebasestorage.googleapis[.]com/v0/b/composed-anvil-370809.appspot.com/o/f6lRfSavTD%2FSetup_Win_03-01-2023_08-37-05.zip?alt=media&token=6a578eb6-d723-4f6b-9cf9-f2575dc56ccb

IcedID downloader:
6b4239bdb1080b21570feba7058d87b35e18bc74c20c68611c2012002b8a0aa3
30fc78d96fc1814753b38958207e80727e9fd9b016ab951c93a3ddddfc643731

IcedID C2:
whothitheka[.]com