Fake Browser Updates Deploy AsyncRAT and Malicious BOINC Clients

Jul 17, 2024 · Original article ↗

Summary

Huntress traced fake-browser-update infections to fileless AsyncRAT and BOINC clients repurposed as C2. Two malicious BOINC servers had about 10,000 connected clients, but researchers observed no tasks issued or further payloads.

Key points

Compromised websites showed fake browser-update prompts; malicious JavaScript and obfuscated PowerShell launched the subsequent infection stages.
Separate infection chains led to fileless AsyncRAT and BOINC clients configured to connect to malicious servers instead of legitimate science projects.
The BOINC installer placed clients under AppData, renamed executables to resemble Windows software, and created scheduled tasks for persistence.
Huntress counted 8,453 clients on rosettahome[.]cn and 1,579 on rosettahome[.]top as of July 15, 2024.
The researchers reported that neither server showed tasks executed as of July 15, and they had not observed additional payloads delivered through BOINC; the attackers’ intent remained unclear.
Huntress recommended monitoring for BOINC execution, renamed clients, suspicious PowerShell activity, headless conhost launching PowerShell, and unexpected scheduled tasks.

Article Details

Attack Vectors: A compromised website presents a fake browser-update prompt; downloading and launching the update runs malicious JavaScript that downloads later stages.
PowerShell loaders use obfuscation and staged decoding to retrieve and execute payloads, including fileless AsyncRAT.
A separate chain downloads BOINC, renames its executable, and creates scheduled tasks to run it while connecting to malicious BOINC servers.
The AsyncRAT chain uses an anti-VM check and DGA-generated domains for command-and-control.
Defensive Notes: Monitor for BOINC installation or execution, particularly renamed BOINC executables running from AppData or other nonstandard locations.
Review PowerShell Operational Event ID 4104 logs for suspicious scripts, including the string `rename-item "boinc.exe"`.
Monitor Windows Security Event ID 4698 for new scheduled tasks that execute software from suspicious locations such as AppData subdirectories.
Investigate PowerShell downloads from suspicious .top domains and headless conhost.exe processes launching PowerShell.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ga1yo3wu78v48hh[.]top`	C2 domain contacted by the final AsyncRAT payload.
DOMAIN	`klmnnilmahlkcje[.]top`	Listed as a C2 server domain.
DOMAIN	`rosetta[.]cn`	Listed as a malicious BOINC server domain.
DOMAIN	`rosetta[.]top`	Listed as a malicious BOINC server domain.
DOMAIN	`rosettahome[.]cn`	Malicious BOINC server with thousands of reported client connections.
DOMAIN	`rosettahome[.]top`	Malicious BOINC server that collected connections from infected clients.
DOMAIN	`rzegzwre[.]top`	C2 and payload-staging domain used in the infection chain.
IPV4	`104[.]200[.]73[.]68`	Listed as an IP address for a malicious BOINC server.
IPV4	`104[.]238[.]34[.]204`	Malicious BOINC server IP; Huntress observed a renamed BOINC client connecting to it.
IPV4	`216[.]245[.]184[.]105`	Listed as a C2 server and used to host the BOINC-chain PowerShell download.
IPV4	`5[.]161[.]214[.]209`	Listed as a C2 server for the AsyncRAT payload.
IPV4	`64[.]7[.]199[.]144`	Listed as an IP address for a malicious BOINC server.
IPV4	`64[.]94[.]84[.]200`	Listed as a C2 server for the activity.
SHA256	`01a8aeb0b350a1325c86c69722affd410ff886881a405743e1adb23538eff119`	Hash listed for the malicious Get-PhysicalExtentAssociation_QoS.log file.
SHA256	`380bd5f097b8501618cf8b312d68e97b3220c31172f82973fce3084157caa15e`	Hash listed for a malicious update.js file.
SHA256	`4716011ca9325480069bffeb2bbe0629fec6e5f69746f2e47f0a6894f2858c0b`	Hash listed for a malicious update.js file.
SHA256	`91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3`	Hash listed for renamed BOINC.exe samples used in the malicious installation.
SHA256	`c5bfe4ddcf576b432f4e6ccce10dd3d219ee5f54497e0cc903671783924414a6`	Hash listed for the malicious Disable-NetAdapterPacketDirect.log file.
URL	`hxxp[:]//rzegzwre[.]top/f23.svg`	Malicious SVG payload-download URL shown in the infection-chain observables.