Braodo Info Stealer Targeting Vietnam and Abroad

ETLM ATTRIBUTION

The Cyfirma research team consistently explores emerging threats, malware, and Tactics, Techniques and Procedures (TTPs) employed by threat actors. We actively monitor existing threats, track ongoing campaigns, assess their progress, and stay vigilant for any novel developments within this landscape.

Braodo stealer malware de-obfuscates itself and downloads a second-stage payload hosted on GitHub. The following GitHub repositories were identified as hosting the Braodo Stealer malware: See Figures 1 & 2.

We discovered multiple variants of Braodo stealer downloader (in formats like BAT, MSI, HTA) and python payloads (like Document.zip, Documentt.zip), all hosted on an open directory HTTP server at the IP: 103[.]54[.]153[.]116. (Refer to Figure 3 for details.)

The multiple variants include BAT, MSI, and HTA all delivering the same python payload of Braodo Stealer, which steals browser data from victims.

Among the aforementioned variants, the ‘breakingbad.bat’ script is an obfuscated script. Upon de-obfuscation, it reveals another hosting server – 45[.]147[.]97[.]170 – associated with threat actors. See Figure 4.

Both servers, ‘103[.]54[.]153[.]116′ and ’45[.]147[.]97[.]170’, appear to be hosting services located in Singapore and France, respectively.

Interestingly, the ASN of the Singapore IP, 103[.]54[.]153[.]116, hosts a few other services that appear to be non-functional Vietnam government web pages or possibly phishing pages. These IPs share the same ASN, computer name, and OS build as the threat actor’s IP. See Figures 5 & 6.

Based on the titles of the above webpages, they seem to be named “VNeID – National Population Data Center” and “PUBLIC SERVICE PORTAL POLICE”. These pages resemble Vietnam government websites; however, apart from their appearances, we did not find any direct links to official government websites.

Braodo stealer steals browser cookies, saves credentials, and uses telegram channels to exfiltrate the stolen data.

We have identified the following Telegram bots involved in the campaign.

Below are the Telegram chat IDs that were receiving the stolen data.

After analyzing the data exfiltrated by Braodo stealer we found that most of the victims are from Vietnam, while others are from Singapore, the U.S., the Czech, and the Netherlands, See the Map below.

The locations mentioned above are based on the victims’ IP addresses.

The overall distribution of victims is represented in the pie chart below.

ANALYSIS

Upon executing the downloader batch script of Braodo Stealer malware, the following process tree is observed. (Refer to Figure 9 for details.)

Figure 9 shows multiple instances of PowerShell and cmd.exe spawned by the malware’s batch script. Ultimately, it concludes with the execution of python.exe running the ‘sim.py’ script.

The contents of the batch script appear gibberish and are obfuscated. Please refer to Figure 10 below for details.

The operating system interprets this file content as Unicode, displaying gibberish text due to threat actors embedding bytes “FF FE 0D 0A” at the start of the script. See Figure 11.

After removing these starting bytes we can see the original obfuscated content of the script. See Figure 12.

There are numerous variables initialized and subsequently executed using the syntax below. See Figure 13.

Using a customized Python script, we decoded the obfuscated script mentioned above and observed that this code executes another PowerShell script. See Figure 14.

Expanding on the highlighted PowerShell script in above figure 14, we identified the following code. See Figure 15.

This code performs several actions:

• It downloads two files from a GitHub repository:
  • update1.bat: This file is obfuscated similarly and is used to maintain persistence by adding the batch script to the Windows Startup folder.
  • 1.zip: This file contains the main source code of Braodo Stealer.

The highlighted points in Figure 15 describe:

• update1.bat is downloaded from GitHub and saved in the Windows Startup folder.
• 1.zip is downloaded from GitHub and saved in the directory Public\Document.zip.
  
• Document.zip is unarchived (extracted).
• sim.py is executed from the unarchived directory.

This sequence of actions enables the malware to establish persistence, retrieve its main source code, and execute its core functionality. The file Document.zip, downloaded from the GitHub repository, contains the stealer code and is located at path “Lib/sim.py”. This Python-based malware (See Figure 16) functions as an information stealer.

The stealer is named Braodo based on the variables identified in the code. See Figure 17.

Using ipinfo.io, the malware collects telemetry information about the victim. See Figure 18.

The stealer targets the following paths for browsers. See Figure 19.

Malware then dumps all running processes into the file “window.txt”, See Figures 20 & 21.

Six threads are initiated to execute the function hehe(), which in turn executes the browser stealer function. See Figure 22.

The `hehe()` function launches multiple threads for each browser present on the system to steal data. The following functions are utilized by the `hehe()` function:
Get_Chrome()
Get_firefox()
Get_edge()
Get_opera()
Get_brave()
Get_chromium()

Utilizing the functions described above, browser data such as cookies and saved passwords are gathered and stored in a designated exfiltration directory. This information is then compressed into an archive and sent to a Telegram channel. See Figure 23.

CONCLUSION

Braodo Stealer represents a sophisticated threat designed to target users primarily in Vietnam, with a notable impact extending to various countries globally. This Python-based malware utilizes multifaceted techniques, including phishing emails, GitHub repositories for hosting malicious code, and Telegram channels for data exfiltration. Its ability is to obfuscate scripts and maintain persistence through startup. By targeting browser data like cookies and saved passwords, Braodo Stealer poses a significant risk of compromising sensitive information. Vigilance against phishing attempts and regular security updates are crucial defenses against such evolving threats in the cybersecurity landscape. This malware poses a significant threat, potentially leading to financial losses and identity theft for its victims.

LIST OF IOCS

MITRE ATT&CK TTPs

YARA Rul

rule Braodo_Stealer
{
meta:
description = “Braodo Information Stealer Batch script – Detection Rule”
author = “CRT”
date = “2024-07-09”
version = “1.0”
malware_type = “Info Stealer”
strings:
$bytes1 = {FF FE 0D 0A}
$patt1 = /%%..%%..%%..%%..%%..%%..%%..%%..%%..%%/ ascii wide nocase
$str1 = “EnableDelayedExpansion” ascii wide nocase
condition:
filesize >= 5MB and
$bytes1 at 0 and
#patt1 >=800000 and
$str1
}

RECOMMENDATIONS

• Deploy strong endpoint security solutions equipped with advanced threat detection and prevention capabilities to effectively identify and stop malicious activities.
• Use reputable antivirus and anti-malware software that can quickly detect and remove malicious payloads to bolster overall system security.
• Keep operating systems, applications, and security software up to date with regular patches to mitigate known vulnerabilities frequently exploited by cyber threats.
• Implement network segmentation to restrict lateral movement, preventing malware from reaching critical assets and containing potential threats within isolated areas.
• Conduct comprehensive employee training on recognizing phishing threats, emphasizing the risks associated with opening attachments or clicking links in unsolicited emails.
• Educate employees to identify social engineering tactics, empowering them to avoid falling prey to deceptive strategies that may lead to the execution of malicious files.
• Configure firewalls to block outbound communication with known malicious IP addresses and domains associated with command-and-control servers.
• Employ behavior-based monitoring to detect unusual activity patterns, including suspicious processes attempting unauthorized network connections.
• Enforce application whitelisting policies to allow only approved applications, thereby preventing the execution of unauthorized or malicious executables.
• Monitor network traffic for abnormal patterns, such as large data transfers to unfamiliar or suspicious IP addresses, indicating potential threats.
• Develop a comprehensive incident response plan detailing necessary actions in the event of a malware infection, including isolating affected systems and promptly notifying relevant stakeholders.
• Stay updated with the latest threat intelligence reports and indicators of compromise related to malware to proactively detect and mitigate potential threats.
• Implement regular backups of critical data and systems to minimize the impact of ransomware attacks or data loss resulting from malware infections.
• Follow the principle of least privilege (PoLP) by restricting user permissions to only those necessary for specific roles, reducing the impact of malware that relies on elevated privileges.
• Establish and maintain defensive measures by monitoring and blocking Indicators of Compromise (IOCs), enhancing defenses based on tactical intelligence and provided rules.