Pierluigi Paganini
June 20, 2024
New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration
Fortinet FortiGuard Labs researchers detected a new Rust-based information stealer called Fickle Stealer which spread through multiple attack vectors.
The malware has an intricate code and relies on multiple strategies for its distribution, including VBA dropper, VBA downloader, link downloader, and executable downloader.
Attackers typically download a PowerShell script (u.ps1 or bypass.ps1) to perform initial setup tasks. In some cases, attackers used an additional file to download the PowerShell script.
The main objective of the PowerShell script is to bypass User Account Control (UAC) and execute the Fickle Stealer malware. The script also sets up a task to run another script, engine.ps1, after 15 minutes. The script places a genuine and a fake WmiMgmt.msc file in the system directories to bypass UAC. The fake file abuses an ActiveX control to open a web browser with a local URL that serves a page for downloading and executing Fickle Stealer. This method leverages the Mock Trusted Directories technique to execute with elevated privileges without triggering a UAC prompt.
The scripts u.ps1, engine.ps1, and inject.ps1 frequently report their status by sending messages to the attacker’s Telegram bot. The script does this task downloading and executing tgmes.ps1 with each message. tgmes.ps1, is stored in the Temp folder with a random name and deleted after execution. In addition to messages, tgmes.ps1 sends victim details such as country, city, IP address, OS version, computer name, and user name to the Telegram bot.
Fickle Stealer uses a packer disguised as a legal executable. The experts speculate the author developed the packer by replacing some code of a legal executable with the packer’s code. This trick allows the malicious code to avoid static analysis.
“If the environment check is passed, Fickle Stealer sends victim information to the server. The server sends a list of target applications and keywords as a response.” reads the report. “Fickle Stealer sends all files in folders according to the list.”
The information stealer performs a series of anti-analysis checks to determine if it’s running in a sandbox or a virtual machine environment.
The malware stores stolen data in a specific JSON format that has three key-value pairs:
| {“name”: “RB_{Computer name}”, “title”: {File name}, “body”: {File content}} |
The malware targets crypto wallets, plugins, file extensions, and partial paths, along with applications such as AnyDesk, Discord, FileZilla, Signal, Skype, Steam, and Telegram
Fickle Stealer can steal information from web browsers powered by Chromium and the Gecko browser engine, such as Google Chrome, Microsoft Edge, Brave, Vivaldi, and Mozilla Firefox.
“In addition to some popular applications, this stealer searches sensitive files in parent directories of common installation directories to ensure comprehensive data gathering. It also receives a target list from the server, which makes Fickle Stealer more flexible. Variants receiving an updated list are observed. The frequently updated attack chain also shows that it’s still in development.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)
