.webp)
🎯Basically, attackers are using one program to install two types of malware on victims' computers.
What Happened
A newly identified malware campaign has raised alarms in the cybersecurity community. Attackers are now using a single, obfuscated loader to deliver two different threats: the Gh0st Remote Access Trojan (RAT) and CloverPlus adware. This dual-payload strategy allows attackers to maintain long-term control over compromised systems while simultaneously generating revenue through ad fraud.
How It Works
The loader is designed to be stealthy, hiding two encrypted payloads within its resource section. The first payload released is the CloverPlus adware, which modifies browser settings and injects unwanted advertisements. Once this is executed, the loader checks its file path and drops a copy of itself in the system's %temp% folder. It then decrypts the Gh0st RAT client module, which is stored as an encrypted resource.
The Gh0st RAT is launched using the legitimate Windows application rundll32.exe, allowing it to execute under a trusted system process. This method reduces the likelihood of detection by standard security tools. Once active, Gh0st RAT collects system information and establishes a connection to the attacker's command-and-control infrastructure.
Who's Being Targeted
This malware campaign targets both individuals and organizations. The adware disrupts browser functionality, while the RAT can steal sensitive data, capture keystrokes, and provide persistent access to attackers. The combination of these threats makes it a significant risk for any compromised system.
Signs of Infection
Indicators of infection include:
Unusual browser behavior,
wiseman.exe
Modifications to registry
How to Protect Yourself
Security teams are urged to enhance their endpoint monitoring capabilities. Here are some recommended actions: This campaign highlights a shift towards more complex malware delivery strategies, emphasizing the need for robust security measures and constant vigilance.
Detection
- 1.Monitor for rundll32.exe loading non-standard file extensions from unusual directories.
- 2.Flag any process execution originating from the %temp% folder.
Removal
- 3.Set alerts for registry modifications to Run keys and RemoteAccess service paths.
- 4.Keep detection rules updated to align with MITRE ATT&CK techniques relevant to this malware.
🔒 Pro insight: The dual-payload approach signifies a strategic evolution in malware delivery, increasing both persistence and monetization opportunities for attackers.
