Ducktail malware spreading through fake clothing job ads

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – Used to deliver the archive containing the malicious executable and decoy PDF (‘The campaign saw the bad actor send out an archive containing images of new products by bona fide companies along with a malicious executable disguised with a PDF icon.’).
• [T1176] Browser Extensions – Persistence achieved by installing a malicious extension into the Chrome user profile and forcing browsers to load it (‘the malware would install a browser extension capable of stealing Facebook business and ads accounts’).
• [T1059.001] Command and Scripting Interpreter: PowerShell – The dropper writes and runs a PowerShell script param.ps1 to open the decoy and orchestrate process actions (‘the malicious file saves a PowerShell script named param.ps1 and a PDF decoy locally to C:UsersPublic. The script uses the default PDF viewer… pauses for five minutes, and then terminates the Chrome browser process.’).
• [T1129] Shared Modules – Use of a malicious library (libEGL.dll) loaded by the parent executable to perform shortcut modification and extension loading (‘the parent executable saves a malicious library named libEGL.dll to C:UsersPublicLibraries and then loads it. When launched, the library goes over every LNK file… altering the launch string for all Chromium-based browsers’).
• [T1204.002] User Execution: Malicious File – Victim opens the attachment believing it to be a PDF/job document, triggering the infection (‘When started, the malware would open a real, embedded PDF file that contained the job details.’).
• [T1539] Steal Web Session Cookie – The extension collects cookies and account session data from the browser to hijack Facebook sessions (‘the extension snatches cookies and details of accounts that the victim is signed in to on the device.’).
• [T1583.001] Acquire Infrastructure: Domains – Attackers used domains registered (Vietnam) as C2 for exfiltration and control (‘Stolen credentials and cookies are forwarded to a C&C server registered in Vietnam.’).
• [T1589] Gather Victim Identity Information – Campaign targeted marketing professionals and harvested account-related info for monetization (‘targeted marketing professionals… the attack was tailored to target marketing professionals looking for a career change.’).
• [T1598.002] Phishing for Information: Spearphishing Attachment – Phishing attachments used to trick victims into revealing credentials or executing payloads (‘The campaign saw the bad actor send out an archive… along with a malicious executable disguised with a PDF icon.’).
• [T1027] Obfuscated Files or Information – Core extension script and other components are obfuscated and some strings are AES-encrypted to hinder analysis (‘The core exception script is obfuscated.’; ‘Some of the library strings required for the malicious code to run are encrypted with the AES-CBC key “gnghfn47n467n43b” and the initialization vector “dakfhskljh92384h”.’).
• [T1071.001] Application Layer Protocol: Web Protocols – Extension communicates with C2 servers over web protocols to exfiltrate data and receive instructions (‘constantly sends the details of all open browser tabs to the command-and-control (C&C) server… Stolen credentials and cookies are forwarded to a C&C server’).
• [T1132.001] Data Encoding: Standard Encoding – Data encoding used for communications to C2 (noted in MITRE table as part of C2/exfiltration techniques).
• [T1041] Exfiltration Over C2 Channel – Credentials, cookies and other harvested data are sent to attacker-controlled C2 domains (‘Stolen credentials and cookies are forwarded to a C&C server registered in Vietnam.’).