Full Report
Huntress has observed new behaviors in conjunction with the malware SocGholish. Read on to understand the implications of this threat and how you can better protect yourself.
Analysis Summary
# Tool/Technique: SocGholish (FakeUpdates) variant leading to BOINC
## Overview
SocGholish (also known as FakeUpdates) is a JavaScript-based malware loader primarily distributed through compromised websites that present users with fraudulent browser update notifications. Historically used to deploy Remote Access Trojans (RATs), recent campaigns observed in July 2024 have evolved to include a "fileless" AsyncRAT loader and the deployment of the BOINC (Berkeley Open Infrastructure Network Computing) volunteer computing software, likely for unauthorized resource utilization or as a decoy/persistence mechanism.
## Technical Details
- **Type:** Malware Family (Loader/Downloader)
- **Platform:** Windows
- **Capabilities:** AMSI evasion, Anti-VM checks, Domain Generation Algorithm (DGA), persistence, credential harvesting (via secondary payloads), and distributed computing deployment.
- **First Seen:** Early 2018 (General family); July 4, 2024 (BOINC variant).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.007 - Command and Scripting Interpreter: JavaScript]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools (AMSI Bypass)]
- [T1027 - Obfuscated Files or Information]
- [T1497 - Virtualization/Sandbox Evasion]
- **[TA0011 - Command and Control]**
- [T1568.002 - Dynamic Resolution: Domain Generation Algorithm]
## Functionality
### Core Capabilities
- **Social Engineering:** Redirects users to high-fidelity fake update pages for Chrome, Firefox, or Edge.
- **Obfuscated Loading:** Uses heavily obfuscated PowerShell scripts with character arrays and XOR encryption (Key: `bj3rtga4myi5`).
- **AMSI Evasion:** Employs known memory patching techniques to bypass Antimalware Scan Interface.
- **DGA Infrastructure:** Utilizes a custom DGA to generate Command and Control (C2) domains, complicating domain-based blocking.
### Advanced Features
- **Fileless Execution:** Loads AsyncRAT directly into memory without writing the final payload to disk.
- **Multi-Chain Infection:** Simultaneously executes two disjointed infection chains:
1. **Chain A:** High-stealth AsyncRAT for long-term C2.
2. **Chain B:** Deployment of BOINC, utilizing legitimate volunteer computing software to hide malicious activity or harvest CPU resources.
- **Environment Fingerprinting:** Performs a "VM Threshold" check, calculating a score based on hardware specs and drivers before delivering the final stage.
## Indicators of Compromise
- **File Names:** `Update.js`, `BrowserUpdate.js`
- **XOR Key:** `bj3rtga4myi5`
- **Network Indicators:**
- `rzegzwre[.]top` (Staging)
- `ga1yo3wu78v48hh[.]top` (AsyncRAT C2)
- Direct IP access used for BOINC chain components.
- **Behavioral Indicators:**
- `powershell.exe` making external curl/web requests to `.top` domains.
- Unexpected presence of BOINC (Berkeley Open Infrastructure Network Computing) in corporate environments.
- Atypical AMSI patching behavior in PowerShell memory.
## Associated Threat Actors
- **Exotic Lily** (Initial Access Broker)
- **TA505** (Historically linked)
- **Evil Corp** (Associated with SocGholish infrastructure)
## Detection Methods
- **Behavioral Detection:** Monitor for PowerShell executing `IEX` (Invoke-Expression) on content retrieved via `Net.WebClient` or `curl` from newly registered or DGA-like domains.
- **AMSI Monitoring:** Alert on scripts containing known AMSI bypass patterns (e.g., `AmsiScanBuffer` memory offsets).
- **YARA Rules:** Target the specific XOR decryption routine and the character array reassembly pattern used in the Stage 2 and Stage 3 PowerShell scripts.
## Mitigation Strategies
- **User Education:** Train users to identify fake browser update prompts and emphasize that modern browsers update automatically or via internal settings menus.
- **Network Filtering:** Block newly registered domains (NRDs) and traffic to `.top` TLDs if not required for business.
- **Endpoint Hardening:**
- Restrict PowerShell to "Constrained Language Mode" via AppLocker.
- Implement Windows Defender Application Control (WDAC) to prevent unauthorized binaries (like BOINC or RATs) from executing.
- **Web Security:** Use ad-blockers and script-blockers to prevent the initial malicious JavaScript from loading on compromised sites.
## Related Tools/Techniques
- **AsyncRAT:** The final payload used for persistent remote access.
- **NetSupport RAT:** A common alternative payload for SocGholish.
- **Gootloader:** Another JavaScript-based loader with similar initial access vectors.