The Duck Who Sneaked Through Feeds

Malicious Facebook Ads

Malvertisements are one of many infection vectors that threat actors use. It gives them an advantage to pique the interest of unsuspecting users to fall victim to their attacks. With many reports and research making the rounds for the past month, we encountered one shared by a user.

This specific case poses as an advertisement for GoggleAI exclusive to EU countries, baiting users to clicking and installing it by including a free installation code in the ad. Investigating the link further, it will serve a RAR file named AIgoogle Assistant Setup.rar when clicked. The password for the archive file is “free”. An MSI file is extracted named Setup.msi.

Image may be NSFW.
Clik here to view.

Analysis from Varist’s Hybrid Analyzer reports malicious indicators, which we can use as reference while digging through the installed components.

Image may be NSFW.
Clik here to view.

Executing Setup.msi drops multiple files, which include components used to install a fake Google Translate Chrome extension.

Image may be NSFW.
Clik here to view.

One of the Chrome extension component is a JavaScript containing most of the malicious code, verified as a Facebook profile grabber similar to the one reported by Trend Micro, which Varist detects as JS/ExtenBro.B!Eldorado.

Image may be NSFW.
Clik here to view.

Looking through the code, we find the following string variables, which were also present in a recently leaked package of a LnkBotBuilder. These strings appear to be part of a campaign ID linking to Operation Ducktail, which lead us to investigate further.

Image may be NSFW.
Clik here to view.

Big Brands, Big Opportunities

Operation Ducktail is cybercrime campaign that targets individuals and businesses in digital marketing and advertising sectors active on Meta’s Facebook Ads and Business platform as reported by WithSecure, The threat actors, which were attributed as Vietnamese in descent, pose as big brands luring their targets with potential brand collaboration, which would be a big break for businesses and rising social media influencers. Unfortunately, Operation Ducktail only brings despair to these businesses and individuals as their end goal is to steal information and eventually the businesses themselves.

Researching for more information on this operation, we found a related campaign using the Calvin Klein brand to lure victims by sending a file named CALVIN KLEIN NEW CAMPAIGN.zip, which contains an LNK file that executes an encoded PowerShell script as shown in the code snippet below.

Image may be NSFW.
Clik here to view.

This PowerShell script decodes to another shell script, which is split into two (2) parts stored in variables $cjsftwh and $jwyihaoqk as highlighted in the code snippet shown below.

Image may be NSFW.
Clik here to view.

The 7dc.ps1 file is also obfuscated using Base64 so we will just use the deobfuscated source for readability. Once the code is deobfuscated, it’s pretty straight forward.

Image may be NSFW.
Clik here to view.

The script will try to perform some Windows Defender Bypass and disable event tracing for windows.

Image may be NSFW.
Clik here to view.

It will try to download a decoy document named “CALVIN_KLEIN__CONTACT_PARTNERSHIP_FORM.docx” to make it seems legitimate. But they just want more information to steal from the victim.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

In preparation for downloading its payload, it will try to add C:\Windows\Temp to the exclusion list of Windows Defender. It will disable scheduled and real-time scanning for the files in the folder.

Image may be NSFW.
Clik here to view.

It will try to download 2 payloads. If one of them succeeds, it will try to install as a scheduled task as its persistence mechanism before executing it.

1. hxxps://wordpress[.]ductai[.]xyz/bdata/data
   • File name: C:\Windows\Temp\svczHost.exe
   • Task name: zServicequyet2
2. hxxps://wordpress[.]ductai[.]xyz/bdata/fbmain
   • File name: C:\Windows\Temp\svczxHost.exe
   • Task name: zServicequyet2x

Image may be NSFW.
Clik here to view.

The executable payload tries to connect to the following URLs in attempt to download another payload. Unfortunately, as of this writing the file is no longer available.

• hxxp://vulinh.online/mainb/ws
• hxxps://wordpress.ductai.xyz/mainb/ws

Best Practices and Recommendations

These attacks prove that threat actors will make the most out of the opportunity presented to them if the proper solution is not yet set in place. Facebook is also monitoring such threats in their platform. With the help of the security researchers, they are devising solutions to thwart these attacks.

Varist highly recommends keeping your antivirus definitions up to date and exercising caution when opening attachments, even if they are from someone you trust, doing so will help protect you from social engineering attacks delivering malware. 

Indicators of Compromise

References

• https://labs.withsecure.com/publications/ducktail
• https://www.trendmicro.com/en_za/research/23/h/profile-stealers-spread-via-llm-themed-facebook-ads.html
• https://0xstarlight.github.io/posts/Bypassing-Windows-Defender/
• https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
• https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/