SEO-Poisoned Software Sites Spread Poseidon, Gh0stRAT and Other Malware
Summary
Hunt researchers found fake Signal, TradingView, AICoin, and Sleipnir download sites distributing malware, including Poseidon and a Gh0stRAT variant, through poisoned search results and typosquatted domains.
Key points
- Lookalike software download sites used typosquatted domains, search keywords, and convincing pages to appear legitimate.
- A fake Sleipnir installer delivered an AppleScript resembling Poseidon/AMOS/Rodrigo stealers and contacted infrastructure also reported in a similar Mac campaign.
- A fake TradingView download provided a trojanized Windows executable that contacted a remote host; the article reports no further information about that host.
- Fake AICoin pages offered Android and Mac downloads. The APK was detected as malicious by five VirusTotal vendors; the DMG was marked clean but showed questionable system-information discovery behavior.
- A fake Signal installer was identified by Hatching Triage as a Gh0stRAT variant and contacted a remote host.
- The researchers recommend security assessments, user education, and approved software policies to reduce risk from fraudulent installers.
Article Details
- Attack Vectors
- SEO poisoning and malvertising use typosquatted or lookalike software-download sites, keywords, and redirects to lure users into downloading malicious installers.
- A fake Sleipnir installer delivers a Mac DMG containing a large hex-encoded AppleScript resembling Poseidon/AMOS/Rodrigo stealer.
- A fake TradingView download provides a ZIP containing a trojan executable; the executable makes a TCP request to a listed host and port.
- Fake AICoin pages distribute Android APK and Mac DMG downloads. The APK is identified as malicious by VirusTotal vendors; the DMG is reported clean by VirusTotal and Hatching Triage but exhibits questionable system-information discovery behavior.
- A fake Signal installer delivers an MSI identified by Hatching Triage as a Gh0stRAT variant; the MSI contacts a listed domain and port.
- Defensive Notes
- The article recommends regular security assessments, user education, and approved software policies.
- Verify software downloads against the legitimate developer’s site and be cautious of search-result installers on lookalike domains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 3426ce901e21b195e4609153c509b595b71edeb2 | SHA-1 hash of the SignalSetup.msi identified by Hatching Triage as a Gh0stRAT variant. |
| SHA1 | 71b510fa5dc20fd55218c1decf3db65b0f4c9377 | SHA-1 hash of the TradingView.exe trojan dropped from the ZIP. |
| SHA1 | 7c73f1df9d1f9708bcf84617c52ef3c4fe9ce87c | SHA-1 hash of the AICoin APK identified as malicious by VirusTotal vendors. |
| SHA1 | 7f9f68c91675e06745c7567d3baa563616fe8b7d | SHA-1 hash of the fake Sleipnir installer DMG containing the stealer script. |
| SHA1 | 91ddde751f30248348d70511de79ec394d5ed33f | SHA-1 hash of the AICoin DMG, reported clean by VirusTotal and Hatching Triage but with questionable system-information discovery behavior. |
| SHA1 | b91d8478178eb80c1b490fe62fa534aaef47c154 | SHA-1 hash of the trojan-delivering TradingView.zip file. |
Malware
Atomic macOS Stealer (AMOS)Analyzing the DMG in Hatching Triage, we see a large hex-encoded Apple Script resembling Poseidon/AMOS/Rodrigo stealer. In this case, the IP used for exfil, 79.137.192_4, matched a report by Malwarebytes in a similarGh0stRATFigure 13: VirusTotal results of aicoin.apk (Source: VirusTotal)Signal Gh0stRATPoseidonAnalyzing the DMG in Hatching Triage, we see a large hex-encoded Apple Script resembling Poseidon/AMOS/Rodrigo stealer. In this case, the IP used for exfil, 79.137.192_4, matched a report by Malwarebytes in a similarRodrigoAnalyzing the DMG in Hatching Triage, we see a large hex-encoded Apple Script resembling Poseidon/AMOS/Rodrigo stealer. In this case, the IP used for exfil, 79.137.192_4, matched a report by Malwarebytes in a similar
Vendors
Products
AICoinmalicious search results. Among the affected are TradingView, an app for traders and investors, and AICoin, a digital currency platform.Hatching TriageAnalyzing the DMG in Hatching Triage, we see a large hex-encoded Apple Script resembling Poseidon/AMOS/Rodrigo stealer. In this case, the IP used for exfil, 79.137.192_4, matched a report by Malwarebytes in a similarMicrosoft Bingmythology, is a web browser developed by Fenrir Inc., a Japanese company. Performing a search in Microsoft Bing returns the malicious site sleipnirbrowser_org (notice the spelling of the title) within the first 5SignalIn this blog post, we will explore instances of websites masquerading as well-known software, including Signal, TradingView, and Sleipnir web browser. The attackers meticulously designed the download pages to appearSleipnirexplore instances of websites masquerading as well-known software, including Signal, TradingView, and Sleipnir web browser. The attackers meticulously designed the download pages to appear legitimate; one site evenTradingViewpost, we will explore instances of websites masquerading as well-known software, including Signal, TradingView, and Sleipnir web browser. The attackers meticulously designed the download pages to appear legitimate;VirusTotalVendor detections in VirusTotal are unable to come up with a malware family, but the EXE is categorized as a trojan.