Byakugan, a new multi-functional malware, was discovered in January 2024 and was distributed through a phishing campaign that used a Portuguese PDF document with a link to a fake Adobe Acrobat Reader installer.
It is a node.js-based malware that can steal various types of information, including cookies, credit cards, downloads, and auto-filled profiles. It can also monitor the target’s desktop using OBS Studio and mine cryptocurrency.
Employing anti-analysis techniques and persistence mechanisms to evade detection and ensure continued execution.
The PDF phishing attack utilizes a social engineering tactic by presenting a blurred table and urging the user to click a malicious link for supposedly clearer content, and by clicking the link, it downloads a downloader disguised as a legitimate installer (Reader_Install_Setup.exe).
The downloader drops a copy of itself (require.exe) alongside a benign installer in the temporary folder. To bypass potential restrictions, it then downloads a DLL and leverages DLL hijacking to execute require.exe.
The secondary require.exe, due to its name and location, fetches the main malicious module (chrome.exe), highlighting the importance of user awareness and avoiding links from untrusted sources, as seemingly harmless actions can trigger a multi-staged malware download.
Byakugan, a node.js malware, is delivered through a downloader that retrieves its main module and commands from thinkforce.com.br, potentially an attacker-controlled server.
It utilizes libraries for functionalities like screen monitoring, keylogging, and information stealing while downloading additional files and storing them, along with Byakugan-generated data, in the %APPDATA%ChromeApplication folder.
It is a Node.js-based malware that utilizes streamer.js to leverage OBS Studio for desktop monitoring and also capture screenshots via Windows APIs through api.js.
Employing miner.js to manage cryptocurrency mining allows the attacker to choose between CPU or GPU mining and even pause mining during high-resource usage.
It downloads popular miners like Xmrig, T-Rex, and NBMiner. It features a keylogger within api.js that stores data in the “kl” folder.
Byakugan’s files.js library enables file manipulation for uploading and browsing, while Browser.js steals browser information like cookies, credit cards, downloads, and auto-filled profiles, storing it in the “bwdat” folder, which injects cookies as well.
It also employs anti-analysis techniques to evade detection and if the executable name or location deviates from legitimate Chrome files, it masquerades as a memory manager and self-terminates.
Manipulating Windows Defender’s exclusion paths and firewall rules to shield itself and to ensure persistence, Byakugan creates a configuration file within the Defender folder, triggering automatic execution at system startup via the task scheduler.
An investigation identified by Fortinet potentially compromised GitHub repositories Thomasdev33k, fefifojs, and Wonderreader also revealed communication with C2 servers blamefade.com.br and thinkforce.com.br, likely used by the attacker for command and control.
Also Read: Hackers Use Raspberry Pi For Online Anonymity
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.