Recent security research has revealed that a new MaaS tool, AresLoader, is being exploited in various attack campaigns. It is apparently created and used by pro-Russian hacktivists, and is often hidden within legitimate software installation bait.
See also: Twitter: Parts of source code leaked on GitHub
See also: Dark Power ransomware: What we know about the new threat
Intel 471, a well-known threat intelligence firm, came across AresLoader in November when an individual known as AiD Lock and DarkBLUP advertised it on Telegram and two illegal hacking forums. It appears that this individual is no amateur in creating malware, as he had been associated with the AiD Locker RaaS program and the PHANTOM DEV or DeadXInject Hack group prior to this incident.
Last year, the PHANTOM DEV group conducted hacktivist activities and claimed to be aligned with a well-known pro-Russian hacktivist group called the Red Hackers Alliance Russia (RHA R). Unlike most cybercriminals, whose primary goal is to gain financial gain and avoid political involvement, hacktivists are often driven by strong beliefs or national sentiment.
Furthermore, since the war in Ukraine began, we have seen hackers from both sides supporting their respective governments. For example, the Conti ransomware (which no longer exists) warned of launching attacks on critical Western infrastructure on behalf of Russia. It is not surprising that this would happen, seeing as how both Russia and Ukraine are notorious for their cybercrime activity – with some criminals using it to provide aid during times of conflict.
The threat of Russian hacktivists does not only hang over Ukraine, but can also affect any Western nation that provides economic and military assistance. Therefore, organizations in these countries must be well-equipped with capabilities to detect all the tools used by these groups – including AresLoader.
See also: A new Emotet phishing campaign targets US taxpayers
Multiple AresLoader campaigns observed
Malware loaders are a class of malware that has minimal features and is used as the initial payload in attacks to give attackers access to systems and the ability to deploy additional malware. These trojans can be purchased on darkweb markets, where customers pay a recurring fee for customized versions of the virus.
AresLoader is an impressive service available for $300 per month, giving users access to five custom builds. To make things even better, there is an optional “binder” feature that allows you to combine a legitimate application and the trojan into a virtual installer. When running this new version, the command line (cmd.exe) will execute both a .bat script and launch the original genuine application without any problems!
The .bat script contains three PowerShell commands that perform different tasks. The first adds the entire C:\ partition to the Windows Defender exclusion list, the second downloads a malicious payload as a .dll file from a remote URL, and the third command retrieves and executes another .bat script that launches the .dll payload via the system.
Once deployed to a system, AresLoader checks to see if it has administrator privileges. If it does not, it attempts to escalate its privileges using the Windows ShellExecuteA application programming interface (API) and the “runas” command. It then creates a scheduled task for persistence to ensure that it runs across reboots, as well as a registry key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Trojan has basic download and execution capabilities that are used to deploy additional payloads.
"Not many AresLoader instances have been discovered at this time, but the MaaS loader appears to have a few 'clients,'" Intel 471 researchers said. The payloads that Intel 471 and other researchers have observed so far include:
- SystemBC
- Lumma Stealer
- StealC
- Aurora Stealer
- Laplas clipper
Intel 471 has already observed two attack campaigns using AresLoader. In January, threat actors used an alternative method to spread the malware, deploying it via other malware, such as the SystemBC backdoor and the Amadey Trojan, instead of using rogue installers. After the successful deployment, they went on to release the Laplas clipper and cryptocurrency mining malware.
Recently, malware researchers Roberto Martinez and Taisiia Garkava observed another campaign that uses the AresLoader control panel to create malicious installers of legitimate programs that allow Raccoon Stealer to enter. This stealer then developed the infamous AresLoader trojan which unleashed further payloads such as StealC and SystemBC.
Legitimate applications for which rogue AresLoader installers were discovered on VirusTotal include Revo Uninstaller Pro, Wise Care 365, CCleaner Pro, Bandicam Screen Recorder, Freemake Video Converter, and Outbyte Driver Updater.
To protect against AresLoader campaigns, Intel 471 recommends that organizations watch for scheduled tasks created by bat or cmd files, monitor changes to the Windows Defender, require code signature evaluation of .exe and MSI installers to detect manipulation and rogue installers, and configure PowerShell logging .The company's report also contains indicators of compromise and MITRE ATT&CK Framework TTPs related to the AresLoader campaigns they have seen so far.
Information source: csoonline.com
