DeepLoad

the loader spread to connected USB drives

It is common for attackers to compromise legitimate websites or create convincing phishing pages and substitute counterfeit CAPTCHA screens for verification prompts that require visitors to perform a series of manual tasks, including executing a command copied to the clipboard.

In this instance, the command immediately creates a scheduled task to re-execute the loader, so it persists across reboots or partial detection, without the user having to do anything thereafter.

In this campaign, this one command was enough to establish persistent, reboot-surviving access by creating a scheduled task configured to repeatedly re-execute the loader.

These commands typically launch PowerShell, which retrieves and executes remote payloads, thereby enabling the deployment of information stealers and other malicious applications.

Malicious browser prompts or error pages have been leveraged by attackers to lure targets into executing a command

A dedicated entry under technique T1204.004 has also been made under the MITER ATT&CK framework, recognising ClickFix as a unique form of user-assisted malicious execution.

In this instance, the command immediately creates a scheduled task to re-execute the loader, so it persists across reboots or partial detection, without the user having to do anything thereafter.

In this campaign, this one command was enough to establish persistent, reboot-surviving access by creating a scheduled task configured to repeatedly re-execute the loader.

A malicious browser extension captures passwords and session tokens as users type them, persisting across sessions until removed.

The security firm also said organizations need to watch for hackers’ abuse of the Windows Management Instrumentation event subscription feature ... hackers are abusing the feature to redeploy DeepLoad after remediation.

In this instance, the command immediately creates a scheduled task to re-execute the loader, so it persists across reboots or partial detection, without the user having to do anything thereafter.

In this campaign, this one command was enough to establish persistent, reboot-surviving access by creating a scheduled task configured to repeatedly re-execute the loader.

ReliaQuest’s report also describes how the DeepLoad malware hides in the Windows operation system by embedding itself in the rarely scrutinized process that runs the Windows lock screen.

Through asynchronous procedure call (APC) injection, the loader places shellcode into that process’s memory and triggers execution on resume...

The security firm also said organizations need to watch for hackers’ abuse of the Windows Management Instrumentation event subscription feature ... hackers are abusing the feature to redeploy DeepLoad after remediation.

That loader contained “thousands of meaningless variable assignments that resemble routine scripting,” and researchers said this “busy” design was meant to hide the loader’s malicious functionality inside the noise.

To carry out the injection DeepLoad uses a PowerShell feature called Add-Type to generate a temporary Dynamic Link Library (DLL) that is dropped into the compromised computer's Temp directory.

ReliaQuest urged organizations to perform ongoing behavioral analysis of computers on their networks to catch the malware in the act, given that its fileless operations can bypass more traditional static defenses.

The security vendor found the malware writing more than 40 files disguised as Chrome setup files, Firefox installers, AnyDesk shortcuts and other familiar installers, to the USB drive of a compromised host.

ReliaQuest’s report also describes how the DeepLoad malware hides in the Windows operation system by embedding itself in the rarely scrutinized process that runs the Windows lock screen.

Through asynchronous procedure call (APC) injection, the loader places shellcode into that process’s memory and triggers execution on resume...

The malware also disables PowerShell command history to cover its own tracks.

The actual logic — a short XOR decryption routine — sits at the bottom and decrypts shellcode in memory, so no decoded payload touches disk.

From there, mshta.exe, a legitimate Windows utility often abused for remote script execution, reached the attacker’s staging infrastructure and pulled down an obfuscated PowerShell loader.

...decrypts shellcode in memory, so no decoded payload touches disk.

Injection of DeepLoad enabled real-time keylogging

A malicious browser extension captures passwords and session tokens as users type them, persisting across sessions until removed.

Researchers have uncovered a new malware strain capable of stealing credentials immediately after gaining a foothold on a victim network, capturing both stored browser passwords and live keystrokes in real time through a standalone stealer and a malicious browser extension.

Because the malware can collect both stored credentials and passwords that users enter after the compromise, ReliaQuest urged compromised organizations to change all passwords that an affected machine can access.

the loader spread to connected USB drives

Injection of DeepLoad enabled real-time keylogging

...uses mshta.exe, a legitimate Windows utility, to fetch an obfuscated payload from attacker-controlled infrastructure.

Before the main attack chain finishes, a standalone credential stealer, filemanager.exe, is already running on its own infrastructure and can exfiltrate data even if the main loader is detected and blocked.