The PHALT#BLYX campaign is a multi-stage malware infection targeting the hospitality sector, leveraging fake Booking[.]com lures, click-fix social engineering, and fake Blue Screen of Death (BSOD) tactics. Attackers abuse trusted Windows utilities (MSBuild.exe) to execute malicious code, ultimately deploying a customized DCRat (AsyncRAT variant) for remote control, persistence, and secondary payload delivery.
Severity: High
Key Findings
- Target Industry: Specifically targets European hospitality organizations, often using phishing lures themed around Booking[.]com reservation cancellations.
- Attribution: The campaign is linked to Russian-speaking threat actors due to the use of DCRat (commonly sold on Russian forums) and native Russian debug strings found in the malware’s project files.
- Tactical Shift: Attackers have evolved from using simpler .hta files to more evasive “Living off the Land” techniques, specifically abusing MSBuild.exe to bypass traditional security controls.
The Multi-stage Attack Chain
- Initial Access: Victims receive a phishing email regarding a high-value reservation charge (€1,004.38) to create urgency.
- Social Engineering (ClickFix): A link leads to a high-fidelity clone of Booking[.]com that displays a fake “Blue Screen of Death” (BSOD).
- Clipboard Injection: The page instructs the user to “fix” the crash by opening the Windows Run dialog and pressing Ctrl+V and Enter. This executes a malicious PowerShell command silently copied to the user’s clipboard.
- Staging (MSBuild): The PowerShell script searches for the legitimate msbuild.exe binary and uses it to execute a downloaded malicious project file (v.proj).
- Defense Evasion: The malware attempts to “blind” Windows Defender by adding the entire C:\ProgramData directory and common script extensions (.exe, .ps1, .proj) to its exclusion list.
- Final Payload: The loader (staxs.exe) injects DCRat into a legitimate system process (aspnet_compiler.exe) for remote access and potential secondary payload delivery.
Malware Capabilities
- Remote Access: DCRat provides full remote control, including process hollowing, keylogging, and screen streaming.
- Persistence: Establishes persistence by placing a .url file (disguised as “DeleteApp.url”) in the Windows Startup folder.
- Information Stealing: Gathers extensive victim data, including hardware IDs, usernames, OS details, and the title of the active window.
Recommendations
- Educate employees to recognize social engineering that uses fake browser crashes, CAPTCHAs, or Blue Screen of Death (BSOD) simulations.
- Explicitly warn users never to paste script code into the Windows Run dialog (Win + R) or PowerShell terminals when prompted by a website.
- Staff in the hospitality sector should be cautious of urgent financial demands from services like Booking[.]com and should verify such requests through official, out-of-band channels rather than clicking email links.
- Ensure Windows is configured to show file extensions so users can identify suspicious files (e.g., seeing a .url or .proj file instead of a standard document).
- Set alerts for any attempts to add broad directories (like %ProgramData%) or common script extensions (like .exe, .ps1, .proj, .tmp) to antivirus exclusion lists, as this is a primary evasion tactic used in this campaign.
- Monitor for MSBuild.exe executing project files from non-standard or user-writable directories like %ProgramData%.
- Alert on any instances where MSBuild.exe establishes external network connections.
- Regularly audit the Windows Startup folder for suspicious files, particularly .url files with deceptive names like “DeleteApp.url” that point to local executables using the file:// protocol.
- Be alert for outbound traffic on custom ports like 3535, which is used by the DCRat payload for C2 communication.
- Block the IOCs at their respective controls
https://www.virustotal.com/gui/collection/ec6586835e216bc786d01aeb89e6ad1c71741ebc3f9031a941c8ef019d5c03f0/iocs
Source:
- https://www.securonix.com/blog/analyzing-phaltblyx-how-fake-bsods-and-trusted-build-tools-are-used-to-construct-a-malware-infection/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.