BundleBot Malware’s Multi-Stage Infection and Custom Obfuscation

Summary:

Researchers highlight a new and sophisticated stealer/bot called BundleBot, which has been spreading stealthily using the dotnet bundle (single-file), self-contained format. Unlike traditional stealers, BundleBot employs a multi-stage infection chain, targeting victims through Facebook Ads and compromised accounts, leading to phishing websites that mimic regular programs, AI tools, and games. The dotnet bundle (single-file), self-contained format, supported since .NET Core 3.0, allows attackers to create a single executable binary containing the entire dotnet runtime, making it challenging to detect. BundleBot leverages this format, along with custom obfuscation, to evade static detection effectively.[emaillocker id="1283"]

The infection process begins with victims downloading fake program utilities from phishing websites. Upon execution, the first stage downloader, delivered as a "RAR" archive, retrieves the second stage in the form of a password-protected "ZIP" archive. The second stage contains the BundleBot, which is the main threat. BundleBot's main capabilities include stealing Facebook account information, making the campaigns potentially self-feeding, as stolen information is used to spread the malware further. The research details a specific infection chain related to the fake utility "Google AI," used to lure victims.

The analysis of BundleBot presents challenges due to the dotnet bundle format. Researchers need to extract the binary's content to investigate each file statically, and tools like AsmResolver assist with this task. Debugging the dotnet assemblies can be challenging, but the latest release of dnSpyEx improves debugging support for self-contained dotnet bundle files. The main problem lies in deobfuscating the dotnet assemblies within the bundle. Researchers can use a guide to preserve debugging by converting the self-contained bundle into a non-self-contained, non-single-file .NET program. This allows the program to utilize the dotnet runtime installed on the system.

BundleBot's use of Facebook Ads and compromised accounts as initial infection vectors, combined with the sophisticated dotnet bundle format and custom obfuscation, enabled it to operate stealthily for months, evading static detection. The research provides valuable insights into analyzing such threats and highlights the importance of proactive security measures to counter sophisticated malware like BundleBot.

Threat Profile:

References:

The following reports contain further technical details:

https://research.checkpoint.com/2023/byos-bundle-your-own-stealer/