DOUBLECUP ClickFix has malware embedded on the internal image.

DOUBLECUP ClickFix has malware embedded on the image inside the web browser cache.

According to a report by the website Bleeping Computer, a new ClickFix campaign intended to release a Loader malware called CountLoader on its victims was later able to infect victims with a variety of other malware. The Threat Research Unit from SOCRadar, a cybersecurity expert, said that the campaign introduced a Loader-as-a-Service tool from Russia called DOUBLECUP.

This tool is more than just malware, but it is an infrastructure to release malware, such as creating a malware release campaign and creating code to release malware to embed on the user's website. There are also many other services such as hosting PNG images with steganography, managing session endpoints and communication signals, Encryption Keys and Payload Automatically. This tool service provides website creation, website deposit hosting to embed ClickFix code created by the tool, add tool-derived code, and add other Obfuscation code as you like.

For the use of the tool, it can be called simple. Just use the application received after paying and customize such values as campaign domain, URL, steganography, Embed type, Execution Action, and Payload address. This process leads to the creation of API Configuration Endpoint settings. What the user gets back is the URL of the image with the malware code embedded, the file size, the session of the Endpoint, and the set of commands that are set to suit. Many different web browsers, such as Chrome, Edge, Firefox, Brave, and Opera. After that, hackers will add the received code to the fake website they created. This code will automatically retrieve the Configuration, load files with the malware code hidden on the cache in the victim's web browser, register the connection check, select the command set that matches the victim's web browser, and copy the victim's Clipboard.

The most interesting point of this tool is to hide Payload in the PNG image. It is loaded on the web browser's cache. The process starts with the victim entering the login page of popular business software such as NetSuite, Odoo, HubSpot, and Salesforce. After the victim enters the website, the DOUBLECUP tool registers the session, detects the victim's public IP number, and forces the web browser to load the payload code latent image into the cache. After that, the page takes the victim to the CaptCha (fake) ClickFix page. With an Instruction command that instructs the victim to paste the malware command into Run and press Run to execute the command. If the victim follows, it will search for the image in the cache according to the defined file size. Then use the findstr or certutil command to recover it (Recover) and run the payload code contained within the image. The first payload will lead to the second payload in a file-free format that feeds the victim's IPV4 public IP number to create a decryption key. Take off the last payload. After the second malware confirmed the last payload against the hardcoded SHA-256, it will release the last payload malware.

The malware released from the last payload was not one, but two.

A CountLoader that stores information about the victim's machine system, checks for applications and extensions of the web browser that serve as the Cryptocurrency Wallet, checks if the Signalled Desktop installation tool exists, and establishes persistence on the victim's system by scheduling himself (Task Scheduling). This malware can also serve as a successor to install other malware into the machine, supporting both PoweShell Module, MSI Install, and DLL files.

DeviceManager RAT is a malware type that takes control of the victim's machine (RAT or Remote Access Trojan). This malware acts to store information about the machine's system by using A Record and TXT Record DNS storage formats to steal the system's data, receive commands from the control server (C2 or Command and Control) to implement it, download the new malware to install it on the victim's machine, and send the results of the command back to hackers. By contacting the C2 server, the malware uses EtherHiding techniques to retrieve the address of the C2 server. Smart Contact on Ethereum or Polygon's Blockchain network makes it difficult to interrupt or suppress.

# Trending # lemon 8 diary # doublecup # clicfix # freedomhack