Hackers Abusing Search Engine Ads to Deliver DANABOT & DARKGATE Malwares

Threat actors are purchasing advertisements for malicious websites to lure victims into downloading malware, which can eventually lead to data theft and ransomware. 

This technique was used in several ad platforms, including search engine ads and social media ads, as they provide a wide range of controls like specific audiences, geographic locations, IP address ranges, browsing history, and device types.

Search Engine Ads Deliver Malware

According to the reports shared with Cyber Security News, there have been four different malware families observed during the investigation of these malicious ad campaigns, which were, 

• PAPERDROP – VBScript-based downloader that communicates with HTTPS and also downloads and executes DANABOT.
• PAPERTEAR – VBScript-based downloader observed to enumerate the list of local processes.
• DANABOT – Backdoor written in Delphi that uses custom binary protocol over TCP.
• DARKGATE – Backdoor written in Delphi that is capable of capturing keystrokes, executing commands, file transfer, and credential theft.

In addition to this three different delivery chains were observed in two of them used a renamed version of cURL binary.

Infection Chain #1: PAPERDROP > DANABOT

In this infection chain, the wscript.exe process is used to initial a DNS request which then executes the Windows installer utility msiexec.exe and installs an application. Furthermore, it uses the rundll32.exe process to load the dropper DLL and executes the “start” function to launch the DANABOT payload.

Infection Chain #2: PAPERTEAR > RENAMED CURL > DARKGATE

In this second infection chain, the PAPERTEAR downloader initiates an HTTP POST request to infocatalog[.]pics over port 8080. After this, the wscript.exe executes the one-liner command that eventually drops the DARKGATE malware onto the victim’s system.

Infection Chain #3: PAPERDROP > RENAMED CURL > DANABOT

The third execution chain is similar to the second one but here the PAPERDROP downloader executes another extended one-liner that uses the renamed curl.exe binary for downloading and installing a malicious package file which drops the DANABOT malware.

Furthermore, a complete report has been published which provides detailed information about the malware capabilities, execution methods, chains, and other information.

Indicators of Compromise

Type	Value	Campaign	Malware Family	Attribution
Domain	www.claimprocessing[.]org	23-046		UNC2975
Domain	www.treasurydept[.]org	23-046		UNC2975
Domain	www.assetfinder[.]org	23-046		UNC2975
Domain	gfind[.]org	23-046		UNC2975
Domain	claimunclaimed[.]org	23-046		UNC2975
Domain	treasurydept[.]org	23-046		UNC2975
Domain	www.myunclaimedcash[.]org	23-046		UNC2975
Domain	freelookup[.]org	23-046		UNC2975
Domain	capitalfinders[.]org	23-046		UNC2975
Domain	plano.soulcarelife[.]org	23-046	PAPERDROP	UNC2975
Domain	pittsburgh.soulcarelife[.]org	23-046	PAPERDROP	UNC2975
Domain	durham.soulcarelife[.]org	23-046	PAPERDROP	UNC2975
Domain	mesa.halibut[.]sbs	23-046	PAPERDROP	UNC2975
Domain	arlington.barracudas[.]sbs	23-046	PAPERDROP	UNC2975
Domain	lugbara[.]top	23-046	PAPERDROP	UNC2975
Domain	lewru[.]top	23-046	PAPERDROP	UNC2975
Domain	infocatalog[.]pics	23-046	DARKGATE	UNC5085
Domain	bikeontop[.]shop	23-046	DARKGATE	UNC5085
Domain	positivereview[.]cloud	23-046	DARKGATE	UNC5085
Domain	dreamteamup[.]shop	23-046	DARKGATE	UNC5085
Domain	whatup[.]cloud	23-046	DARKGATE	UNC5085
Domain	thebesttime[.]buzz	23-046	DARKGATE	UNC5085
IP Address	47.253.165[.]1	23-046		UNC2975
IP Address	8.209.99[.]230	23-046		UNC2975
IP Address	47.252.45[.]173	23-046		UNC2975
IP Address	47.252.33[.]131	23-046		UNC2975
IP Address	47.253.141[.]12	23-046		UNC2975
IP Address	47.252.45[.]173	23-046		UNC2975
IP Address	34.16.181[.]0	23-046	DANABOT
IP Address	35.247.194[.]72	23-046	DANABOT
IP Address	35.203.111[.]228	23-046	DANABOT
IP Address	94.228[.]169[.]143	23-051	PAPERTEAR	UNC5085
MD5	9f9c5a1269667171e1ac328f7f7f6cb3	23-046	DARKGATE	UNC5085
MD5	2c16eafd0023ea5cb8e9537da442047e	23-046	PAPERDROP (Type I)	UNC2975
MD5	7544f5bb88ad481f720a9d9f94d95b30	23-046	PAPERDROP(Type I)	UNC2975
MD5	862a42a91b5734062d47c37fdd80c633		PAPERDROP(Type II)	UNC2956
MD5	650b0b12b21e9664d5c771d78738cf9f		PAPERTEAR	UNC5085
MD5	9120c82b0920b9db39894107b5494ccd	23-051	PAPERTEAR	UNC5085