BundleBot Masquerades as Google Chatbot
A new strain of malicious software, named BundleBot, has been operating covertly, exploiting .NET single-file deployment techniques to clandestinely obtain sensitive information from compromised hosts.
According to a report published by Check Point this week, BundleBot is taking advantage of the dotnet bundle (single-file) self-contained format, resulting in minimal or no detection by static analysis. The malware is commonly distributed through Facebook Ads and compromised accounts, disguising itself as regular program utilities, AI tools, or games.
Some of the fraudulent websites designed to deceive victims simulate Google Bard, a conversational generative artificial intelligence chatbot from Google. These sites lure victims into downloading a fake RAR archive named "Google_AI.rar," which is hosted on legitimate cloud storage services like Dropbox.
Method of Operation
Once unpacked, the archive file contains an executable file ("GoogleAI.exe"), which is the .NET single-file, self-contained application. This executable includes a DLL file ("GoogleAI.dll"), responsible for fetching a password-protected ZIP archive from Google Drive.
The extracted content of the ZIP file ("ADSNEW-1.0.0.3.zip") is another .NET single-file, self-contained application ("RiotClientServices.exe") incorporating the BundleBot payload ("RiotClientServices.dll") and a command-and-control (C2) packet data serializer ("LirarySharing.dll").
The Israeli cybersecurity company explained that the "RiotClientServices.dll" assembly is a custom, new stealer/bot, utilizing the "LirarySharing.dll" library to process and serialize packet data sent to the C2 server as part of the bot communication.
To thwart analysis, the binary artifacts employ custom-made obfuscation and junk code. They possess capabilities to extract data from web browsers, capture screenshots, obtain Discord tokens, extract information from Telegram, and gather Facebook account details.
Check Point also identified a second BundleBot sample that is nearly identical in all aspects, except for its use of HTTPS to exfiltrate information to a remote server in the form of a ZIP archive.
According to Check Point, threat actors have been using Facebook Ads and compromised accounts to deliver malware for some time now, but combining this with malware that can steal Facebook account info can create a "self-sustaining routine".
