Threat actors have begun distributing fake Windows 11 upgrade installers to Windows 10 users, tricking them into downloading and running the RedLine stealer malware.
The timing of the attacks coincides with the moment when Microsoft announced the broad deployment phase of Windows 11, so the attackers were well prepared for this move and were waiting for the right moment to maximize the success of their business.
RedLine stealer is currently one of the most widespread malware, so its infections can have dire consequences for victims.
See also: ESET: What were the most popular attack methods in 2021?
The campaign
According to HP researchers who discovered this campaign, the hackers used the seemingly legitimate domain “windows-upgraded.com” for the malware distribution part of their campaign.
The website appears to be a genuine Microsoft website, and if the visitor clicked the “Download Now” button, they received a 1.5 MB ZIP file named “Windows11InstallationAssistant.zip,” which was retrieved directly from a Discord CDN.
Decompressing the file results in a 753 MB folder, which displays an impressive compression ratio of 99.8%, achieved thanks to the presence of padding in the executable file.
When the victim launches the executable file in the folder, it starts a PowerShell process with a coded argument.
Then, a process is started with a timeout of 21 seconds and after it expires, a .jpg file is downloaded from a remote web server.
This file contains a DLL with contents arranged in reverse order, possibly to avoid detection and analysis.
See also: Apple: A 'small portion' of iPhones record interactions with Siri
Finally, the initial process loads the DLL and replaces the current thread context with it. This DLL is a RedLine stealer payload that connects to the command-and-control server via TCP to receive instructions on what malicious tasks to perform next on the newly compromised system.
Outlook
Although the distribution site is now down, there's nothing stopping the hackers from creating a new domain and restarting their campaign. In fact, that's very likely already happening.
See also: Mozilla Firefox: Fixes bug that granted administrator privileges
Windows 11 is a major upgrade that many Windows 10 users cannot get from official distribution channels due to hardware incompatibilities, which malware operators see as an excellent opportunity to find new victims.
Information source: bleepingcomputer.com
