KongTuke Uses Fake Browser-Crash Fix to Deliver Malware

Summary

Huntress details KongTuke’s NexShield extension, which crashes browsers and tricks users into running malicious commands. The campaign uses staged PowerShell payloads and delivers ModeloRAT to domain-joined hosts.

Key points

NexShield impersonates uBlock Origin Lite and was advertised as an extension in the Chrome Web Store.
The extension delays its payload, exhausts browser resources, then displays a fake security warning that tells users to run a command.
The command uses the legitimate finger.exe utility to retrieve and execute further payloads.
The infection chain checks for analysis tools and whether a host is domain-joined; Huntress reports that domain-joined hosts receive ModeloRAT.
ModeloRAT uses RC4-encrypted HTTP command-and-control, collects system information, supports remote command execution, and establishes registry persistence.
The researchers say the non-domain infection path returned a test payload during analysis, leaving its operational status uncertain.

Article Details

Attack Vectors: A malicious advertisement directed users searching for a Chrome ad blocker to the Chrome Web Store listing for NexShield, which impersonated uBlock Origin Lite.
NexShield delayed its payload for 60 minutes, exhausted browser resources to cause a crash, and displayed a fake security warning prompting users to copy and execute a command.
The copied command used finger.exe to retrieve attacker-controlled content, which led to a multi-stage PowerShell infection chain.
The infection profiled hosts and analysis environments, using a separate payload path for domain-joined systems and a staged, DGA-based chain for standalone systems.
On domain-joined hosts, ModeloRAT provided remote command execution, system reconnaissance, registry persistence, and support for additional payloads.
Defensive Notes: Monitor for unusual use of finger.exe, including copies renamed to ct.exe and commands that pipe its output into cmd.
Review browser extensions for suspicious permissions, recent creation, and impersonation of trusted projects.
Monitor network traffic for nexsnield[.]com, the ModeloRAT C2 IP addresses, and randomly generated .top domains with /st2 or /1.php endpoints.
Watch for pythonw.exe spawning hidden PowerShell processes and suspicious entries in the Windows Run registry key, including names mimicking legitimate software.
Investigate browser resource exhaustion and fake security prompts that instruct users to paste commands into the Windows Run dialog.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`fyvw2oiv[.]top`	DGA domain used by the standalone-host infection chain to retrieve the next stage.
DOMAIN	`nexsnield[.]com`	Attacker-controlled C2 domain used by NexShield for install, update, and uninstall telemetry.
IPV4	`158[.]247[.]252[.]178`	Hardcoded ModeloRAT C2 server.
IPV4	`170[.]168[.]103[.]208`	Hardcoded ModeloRAT C2 server.
IPV4	`199[.]217[.]98[.]108`	Attacker server contacted by the finger.exe command to retrieve content used in the infection chain.
SHA256	`6399c686eba09584bbbb02f31d398ace333a2b57529059849ef97ce7c27752f4`	Hash identified for the GateKeeper .NET payload, 16933906614.dll.
SHA256	`c15f44d6abb3a2a882ffdc9b90f7bb5d1a233c0aa183eb765aa8bfba5832c8c6`	Hash identified for the ModeloRAT modes.py payload.
SHA256	`c46af9ae6ab0e7567573dbc950a8ffbe30ea848fac90cd15860045fe7640199c`	Hash identified for the malicious Chrome extension file.
SHA256	`fbfce492d1aa458c0ccc8ce4611f0e2d00913c8d51b5016ce60a7f59db67de67`	Hash of the NexShield background.js script identified in the indicators table.
URL	`hxxp[:]//temp[.]sh/utDKu/138d2a62b73e89fc4d09416bcefed27e139ae90016ba4493efc5fbf43b66acfa.exe`	Specific payload-download URL identified as delivering the executable saved as aa.exe.
URL	`hxxps[:]//www[.]dropbox[.]com/scl/fi/6gscgf35byvflw4y6x4i0/b1.zip?rlkey=bk2hvxvw53ggzhbjiftppej50&st=yyxnfu71&dl=1`	Specific Dropbox resource identified as hosting the ModeloRAT payload.