![\"Websites](\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2023\/06\/01101851\/Satacom_downloader_01.png\")
<\/a><\/p>\nWebsites with embedded QUADS ad plugin<\/strong> <\/em><\/p>\n The plugin is abused in the same way that other advertising networks are abused for malvertising purposes: the attackers promote ads that look like a “Download” button and redirect users to the attackers’ websites.<\/p>\n WP QUADS ad plugin within the website’s content<\/strong><\/em><\/p>\n After the user clicks on the download button or link, there’s a chain of redirects that automatically takes them through various servers to reach a website masquerading as a file-sharing service to distribute the malware. In the screenshot below, we can see examples of websites that are the final destinations of the redirection chains.<\/p>\n Fake ‘file-sharing’ services<\/strong><\/em><\/p>\n After the user downloads and extracts the ZIP archive, which is about 7MB in size, a few binaries, EXE and DLL files are revealed. The DLLs are legitimate libraries, but the ‘Setup.exe’ file is a malicious binary. It is about 450MB, but is inflated with null bytes to make it harder to analyze. The original size of the file without the added null bytes is about 5MB and it is an Inno Setup type file.<\/p>\n Null bytes added to the PE file<\/strong><\/em><\/p>\n Inno Setup installers usually work as follows: at runtime the binary extracts a child installer to a temporary folder with the name ‘Setup.tmp’. Then it runs the child installer ‘Setup.tmp’ file that needs to communicate with the primary installer with arguments pointing to the location of the original ‘Setup.exe’ and its packages in order to retrieve the BIN data inside the ‘Setup.exe’ file for the next step of the installation.<\/p>\n In the case of the Satacom installer, the Setup.tmp file, once running, creates a new PE DLL file in the Temp directory. After the DLL is created, the child installer loads it into itself and runs a function from the DLL.<\/p>\n It then decrypts the payload of Satacom and creates a new sub-process of ‘explorer.exe’ in order to inject the malware into the ‘explorer.exe’ process.<\/p>\n Based on the behavior we observed, we can conclude that the malware performs a common process injection technique on the remote ‘explorer.exe’ process called process hollowing. This is a known technique used to evade detection by AV applications.<\/p>\n The malicious payload that’s injected into the ‘explorer.exe’ process uses the RC4 encryption implementation to decrypt its configuration data, communication strings and data for the other dropped binaries on the victim’s machine. The encrypted data is stored inside the malicious payload.<\/p>\n The malware uses different hardcoded keys to decrypt the data at each step. There are four different RC4 keys that the malware uses to perform its actions, first decrypting the HEX string data to use it for its initial communication purposes.<\/p>\n RC4 keys (left pane) and encrypted HEX strings (right pane)<\/strong><\/em><\/p>\n In the screenshot above, the left pane shows the four RC4 hardcoded keys as HEX strings, and in the right pane we can see the HEX strings that are decrypted using the RC4 ‘config_strings’ key to get the strings for the first initialization of communication with the C2. If we decrypt the strings ourselves using the key, we get the result shown in the screenshot.<\/p>\n Once the HEX strings are decrypted, ‘explorer.exe’ initiates its first communication. To do so, it performs a DNS request to don-dns[.]com (a decrypted HEX string) through Google DNS (8.8.8.8, another decrypted string) and it queries for the TXT record.<\/p>\n DNS query for TXT record through Google to don-dns[.]com<\/strong><\/em><\/p>\n Once the request is complete, the DNS TXT record is received as another base64-encoded RC4-encrypted string: “ft\/gGGt4vm96E\/jp”. Since we have all of the RC4 keys, we can try to decrypt the string with the ‘dns_RC4_key’ and get another URL as a result. This URL is where the payload is actually downloaded from.<\/p>\n Decrypted string of TXT record<\/strong><\/em><\/p>\n The Satacom downloader downloads various binaries to the victim’s machine. In this campaign we observed a PowerShell script being downloaded that installs a malicious Chromium-based browser extension that targets Google Chrome, Brave and Opera.<\/p>\n The extension installation script is responsible for downloading the extension in a ZIP archive file from a third-party website server. The PowerShell script downloads the archived file to the computer’s Temp directory and then extracts it to a folder inside the Temp directory.<\/p>\n After that, the script searches for the possible locations of shortcuts for each of the targeted browsers in such places as Desktop, Quick Launch and Start Menu. It also configures the locations of the browsers’ installation files and the location of the extension on the computer.<\/p>\n Finally, the PS script recursively searches for any link (.LNK) file in the above locations and modifies the “Target” parameter for all existing browser shortcuts with the flag “–load-extension=[pathOfExtension]” so that the shortcut will load the browser with the malicious extension installed.<\/p>\n Chrome shortcut with the extension parameter<\/strong><\/em><\/p>\n After performing this action, the script closes any browser processes that may be running on the machine, so that the next time the victim opens the browser, the extension will be loaded into the browser and run while the user is browsing the internet.<\/p>\n This extension installation technique allows the threat actors to add the addon to the victim’s browser without their knowledge and without uploading it to the official extension stores, such as the Chrome Store, which requires the addon to meet the store’s requirements.<\/p>\n Extension installation PowerShell script<\/strong><\/em><\/p>\n After installation of the extension, we can analyze its functionality and features by checking specific files stored in the extension’s directory. If we take a look at the first lines of the ‘manifest.json’ file, we’ll see that the extension disguises itself by naming the addon “Google Drive,” so even when the user accesses the browser addons, the only thing they will see is an addon named “Google Drive”, which looks like just another standard Google extension installed inside the browser.<\/p>\n The manifest.json file settings<\/strong><\/em><\/p>\n Another malicious extension file that always runs in the background when the user is browsing is ‘background.js’, which is responsible for initializing communication with the C2. If we take a closer look at the JavaScript code, we’ll find an interesting function call at the bottom of the script with a string variable that is the address of a bitcoin wallet.<\/p>\n Background.js script snippet<\/strong><\/em><\/p>\n Looking at the script’s code, we can conclude that the extension is about to fetch another string from the hardcoded URL, into which the script inserts the bitcoin address. The JavaScript receives data in JSON format, which shows the wallet’s transaction activity, and then looks for a specific string within the latest transaction details.<\/p>\n JSON of the transaction details<\/strong><\/em><\/p>\n There are two strings on the page that contain the C2 address. The “script” string is a HEX string that contains the C2 host of the malware, and the “addr” string is the Base58-encoded C2 address. The reason for using the last cryptocurrency transaction of a specific wallet to retrieve the C2 address is that the server address can be changed by the threat actors at any time. Moreover, this trick makes it harder to disable the malware’s communication with its C2 server, since disabling wallets is much more difficult than blocking or banning IPs or domains. If the C2 server is blocked or taken down, the threat actors can simply change the ‘script’ or ‘addr’ string to a different C2 server by performing a new transaction. And since the extension always checks these strings to retrieve the C2, it will always ask for the new one if it’s ever changed.<\/p>\n Decoded C2 address from the transaction details<\/strong><\/em><\/p>\n The extension has several other scripts that are responsible for initializing the received commands and become functional after the C2 address is retrieved, because the scripts need to obtain some important information from the C2. For example, the C2 holds the BTC address that will be used when the BTC is transferred from the victim’s wallet to the threat actor’s wallet.<\/p>\n Threat actor’s BTC wallet address<\/strong><\/em><\/p>\n To get hold of the victim’s cryptocurrency, the threat actors use web injects on the targeted websites. The web inject script is also provided by the C2 after the extension contacts it. In the following screenshot, we can see the ‘injections.js’ script from the extension, which fetches the web inject script from the C2 server.<\/p>\n The injections.js script<\/strong><\/em><\/p>\n After the addon contacts the C2 server \u2013 extracted as mentioned above \u2013 the server responds with the web inject script that will be used on the targeted websites.<\/p>\n Webinject script from C2 server<\/strong><\/em><\/p>\n If we take a closer look at the script, we can see that the threat actors are targeting various websites. In the version of the script shown above we can see that it targets Coinbase, Bybit, KuCoin, Huobi and Binance users.<\/p>\n Since the script within the C2 can be changed at any time, the threat actors can add or remove other web injection targets, as well as start targeting cryptocurrencies other than BTC, which makes this extension pretty dynamic and allows threat actors to control the malicious extension by changing the scripts.<\/p>\n If we look at the script, we can see that the extension performs various actions on the targeted websites. For example, it has the ability to retrieve the victims’ addresses, obtain account information, bypass 2FA, and much more. Moreover, it’s capable of transferring BTC currency from the victim’s wallet to the attackers’ wallet.<\/p>\n Functions from the web inject script<\/strong><\/em><\/p>\n Looking at the full web inject script, we can conclude that the idea behind it is to steal BTC currencies from victims who have the malicious extension installed. The extension performs various actions on the account in order to remotely control it using the web inject scripts, and eventually the extension tries to withdraw the BTC currency to the threat actors’ wallet. To circumvent the 2FA settings for transactions, the web inject script uses 2FA bypass techniques.<\/p>\n Snippet of the BTC withdrawal function from the web inject script<\/strong><\/em><\/p>\n Before stealing the cryptocurrency, the extension communicates with the C2 server to get the minimum BTC value. It then compares this value with the actual amount of money in the target wallet. If the wallet contains less cryptocurrency than the minimum amount received from the C2, it doesn’t withdraw any cryptocurrency from it.<\/p>\n Minimum amount threshold from C2<\/strong><\/em><\/p>\n The script also performs several other checks before stealing the BTC currency. For example, it also checks the BTC to USD exchange rate.<\/p>\n When the amount of BTC in the target wallet meets the C2 checks, the script performs the withdrawal function to steal the BTC currency from the victim.<\/p>\n Performing balance check<\/strong><\/em><\/p>\n In addition to stealing BTC, the malicious extension performs additional actions to hide its activity.<\/p>\n For example, the malicious extension contains scripts that target three different email services: Gmail<\/em>, Hotmail <\/em>and Yahoo<\/em>. The idea behind the scripts is to hide the email confirmation of the transaction performed by the malicious extension.<\/p>\n Each script makes visual changes to the emails once the victim reaches the email service’s page. It searches for pre-defined email titles and content, and when it finds them, it simply hides them from the victim by injecting HTML code into the message body. As a result, the victim is unaware that a specific transaction transferring crypto currency to the threat actors’ wallet was made.<\/p>\n Extension JS targeting Gmail<\/strong><\/em><\/p>\n In addition, the extension can manipulate email threads from the targeted websites, so if the victim opens a thread from, for example, Binance, it can change the content of the emails and display a fake email thread that looks exactly like the real one. It also contains a placeholder for desired strings that the extension can inject into the content of the message page.<\/p>\n Fake email thread template<\/strong><\/em><\/p>\n The malicious extension has many other JavaScripts and it’s capable of performing additional actions. For example, it can extract information through the browser, such as the system information, cookies, browser history, screenshots of opened tabs, and even receive commands from the C2 server.<\/p>\n JavaScripts: requesting commands from the C2 (left pane) and taking screenshots (right pane)<\/strong><\/em><\/p>\n The purpose of the extension is to steal BTC and manipulate targeted cryptocurrency websites and email services to make the malware as stealthy as possible, so the victim doesn’t notice any information about the fraudulent transactions. The extension can update its functionality due to the technique used to retrieve the C2 server via the last transaction of a specific BTC wallet, which can be modified at any time by making another transaction to this wallet. This allows the threat actors to change the domain URL to a different one in case it’s banned or blocked by antivirus vendors.<\/p>\n This campaign targets individual users around the world. According to our telemetry, in Q1 2023 users in the following countries were most frequently infected: Brazil, Algeria, Turkey, Vietnam, Indonesia, India, Egypt, Mexico.<\/p>\n Satacom is a downloader that is still running campaigns and being developed by the threat actor behind it. This threat actor continues to distribute malware families using various techniques, such as ad injection via ad plugins for WordPress websites.<\/p>\n The recently distributed malware, which is a side-loaded extension for Chromium-based browsers, performs actions in the browser to manipulate the content of the targeted cryptocurrency website. The main purpose of this malicious extension is to steal cryptocurrency from victims and transfer it to the threat actors’ wallet.<\/p>\n Moreover, since it is a browser extension, it can be installed in Chromium-based browsers on various platforms. Although the installation of the malicious extension and the infection chain described in this article are Windows-specific, if the threat actors want to target Linux and macOS users, they could easily do so, provided the victims use Chromium-based browsers.<\/p>\n Satacom files<\/strong> Satacom DNS<\/strong> Satacom C2<\/strong> Hosted PS scripts<\/strong> Malicious extension ZIP<\/strong> Malicious extension CC<\/strong> Hosted Satacom installer <\/strong>ZIP<\/strong> files<\/strong> Redirectors to Satacom installer<\/strong> This table contains all the TTPs identified during analysis of the activity described in this report.<\/p>\n A recent campaign by Satacom downloader is delivering a cryptocurrency-stealing extension for Chromium-based browsers, such as Chrome, Brave and Opera.<\/p>\n","protected":false},"author":2901,"featured_media":107654,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1044],"tags":[452,177,62,71,458,123,30],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/securelist.com\/satacom-delivers-cryptocurrency-stealing-browser-extension\/109807\/"}],"_links":{"self":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/109807"}],"collection":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/users\/2901"}],"replies":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/comments?post=109807"}],"version-history":[{"count":13,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/109807\/revisions"}],"predecessor-version":[{"id":109852,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/109807\/revisions\/109852"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media\/107654"}],"wp:attachment":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media?parent=109807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/categories?post=109807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/tags?post=109807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nThe payload: malicious browser extension<\/h2>\n
<\/a><\/p>\n<\/a><\/p>\nMalicious extension analysis<\/h3>\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nVictims<\/h2>\n
Conclusions<\/h2>\n
Appendix I \u2013 Indicators of Compromise<\/h2>\n
\n0ac34b67e634e49b0f75cf2be388f244<\/a>
\n1aa7ad7efb1b48a28c6ccf7b496c9cfd<\/a>
\n199017082159b23decdf63b22e07a7a1<\/a><\/p>\n
\ndns-beast[.]com<\/a>
\ndon-dns[.]com<\/a>
\ndie-dns[.]com<\/a><\/p>\n
\nhit-mee[.]com<\/a>
\nnoname-domain[.]com<\/a>
\ndon-die[.]com<\/a>
\nold-big[.]com<\/a><\/p>\n
\ntchk-1[.]com<\/a><\/p>\n
\na7f17ed79777f28bf9c9cebaa01c8d70<\/a><\/p>\n
\nyou-rabbit[.]com<\/a>
\nweb-lox[.]com<\/a><\/p>\n
\nht-specialize[.]xyz<\/a>
\nht-input[.]cfd<\/a>
\nht-queen[.]cfd<\/a>
\nht-dilemma[.]xyz<\/a>
\nht-input[.]cfd<\/a>
\nio-strength[.]cfd<\/a>
\nfbs-university[.]xyz<\/a>
\nio-previous[.]xyz<\/a>
\nio-band[.]cfd<\/a>
\nio-strength[.]cfd<\/a>
\nio-band[.]cfd<\/a>
\ncan-nothing[.]cfd<\/a>
\nscope-chat[.]xyz<\/a>
\nstroke-chat[.]click<\/a>
\nicl-surprise[.]xyz<\/a>
\nnew-high[.]click<\/a>
\nshrimp-clock[.]click<\/a>
\noo-knowledge[.]xyz<\/a>
\noo-station[.]xyz<\/a>
\noo-blue[.]click<\/a>
\noo-strategy[.]xyz<\/a>
\noo-clearly[.]click<\/a>
\neconomy-h[.]xyz<\/a>
\nmedical-h[.]click<\/a>
\nhospital-h[.]xyz<\/a>
\nchurch-h[.]click<\/a>
\nclose-h[.]xyz<\/a>
\nthousand-h[.]click<\/a>
\nrisk-h[.]xyz<\/a>
\ncurrent-h[.]click<\/a>
\nfire-h[.]xyz<\/a>
\nfuture-h[.]click<\/a>
\nmoment-are[.]xyz<\/a>
\nhimself-are[.]click<\/a>
\nair-are[.]xyz<\/a>
\nteacher-are[.]click<\/a>
\nforce-are[.]xyz<\/a>
\nenough-are[.]xyz<\/a>
\neducation-are[.]click<\/a>
\nacross-are[.]xyz<\/a>
\nalthough-are[.]click<\/a>
\npunishment-chat[.]click<\/a>
\nrjjy-easily[.]xyz<\/a>
\nguy-seventh[.]cfd<\/a><\/p>\n
\nback-may[.]com<\/a>
\npost-make[.]com<\/a>
\nfilesend[.]live<\/a>
\nsoft-kind[.]com<\/a>
\nee-softs[.]com<\/a>
\nbig-loads[.]com<\/a>
\nel-softs[.]com<\/a>
\nsofts-labs[.]com<\/a>
\nsoft-make[.]com<\/a>
\nsoft-end[.]com<\/a>
\nsoon-soft[.]com<\/a>
\ntip-want[.]click<\/a>
\nget-loads[.]com<\/a>
\nnew-loads[.]com<\/a>
\nfile-send[.]live<\/a>
\nfiletosend-upload[.]net<\/a>
\nfile-send[.]cc<\/a><\/p>\nAppendix II \u2013 MITRE ATT&CK Mapping<\/h2>\n
\n\n
\n Tactic<\/strong><\/td>\n Technique<\/strong><\/td>\n Technique Name<\/strong><\/td>\n<\/tr>\n \n Initial Access<\/strong><\/td>\n User Execution: Malicious Link
\nUser Execution: Malicious File<\/td>\nT1204.001
\nT1204.002<\/td>\n<\/tr>\n\n Execution<\/strong><\/td>\n User Execution: Malicious File
\nCommand and Scripting Interpreter: PowerShell<\/td>\nT1204.002
\nT1059.001<\/td>\n<\/tr>\n\n Persistence<\/strong><\/td>\n Shortcut Modification
\nBrowser Extensions<\/td>\nT1547.009
\nT1176<\/td>\n<\/tr>\n\n Defense Evasion<\/strong><\/td>\n Process Injection<\/td>\n T1055.012<\/td>\n<\/tr>\n \n Credential Access<\/strong><\/td>\n Credentials from Password Stores
\nSteal Web Session Cookie
\nUnsecured CredentialsMulti-Factor Authentication Interception<\/td>\nT1555.003
\nT1539
\nT1552T1111<\/td>\n<\/tr>\n\n Discovery<\/strong><\/td>\n Account Discovery
\nSoftware Discovery
\nSecurity Software Discovery<\/td>\nT1087
\nT1518
\nT1518.001<\/td>\n<\/tr>\n\n Collection<\/strong><\/td>\n Automated Collection
\nScreen Capture
\nCredentials from Password Stores
\nBrowser Session Hijacking<\/td>\nT1119
\nT1113
\nT1555
\nT1185<\/td>\n<\/tr>\n\n Command and Control<\/strong><\/td>\n Application Layer Protocol: Web Protocols
\nApplication Layer Protocol: DNS
\nDynamic Resolution<\/td>\nT1071.001
\nT1071.004
\nT1568<\/td>\n<\/tr>\n\n Exfiltration<\/strong><\/td>\n Exfiltration Over C2 Channel<\/td>\n T1041<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"