BadSpace Malware Attacking Users By Leveraging High-Ranking Infected Websites

June 17, 2024

17 2 minutes read

Untitled design6 — BadSpace20Malware20Attacking20Users20by20Leveraging20High Ranking20Infected20Websites.webp.jpeg

Hackers abuse high-ranking infected websites to leverage their established credibility and large user base to spread malware, launch phishing attacks, or redirect traffic to malicious sites.

While exploiting such trusted infected platforms they can now reach out to larger audiences, increase the efficiency of their attacks, and escape from being caught for a longer period of time through this way.

Cybersecurity analysts at GData Software recently identified that BadSpace malware has been actively attacking users by leveraging high-ranking infected websites.

BadSpace Malware Attacking Users

On May 19th, threat intelligence analyst Gi7w0rm alerted the cybersecurity community about a new backdoor, “BadSpace,” discovered by researcher @kevross33.

Collaborative research identified a multi-stage attack chain involving an infected website, a command and control (C2) server, sometimes a fake browser update, and a JScript downloader to deploy the backdoor.

BadSpace is delivered via infected websites that set a cookie to track first-time visitors.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot

It constructs a URL with device information and sends a GET request, overwriting the original webpage with a malicious payload unless an error occurs.

Infected sites tend to be WordPress sites that inject malicious code into JavaScript libraries or index pages.

Acquired JScript files drop and run BadSpace, sometimes using extension spoofing like “.pdf.js”.

Infection chain (Source – GDATA Software)

Some websites show a fake Google Chrome update window that downloads the backdoor or JScript.

The C2 domains used are associated with the SocGholish threat actor known for using fake updates and JS files.

This attack shares similarities with SocGholish’s delivery methods for backdoors. The JScript file has three functions and an array of strings that utilize obfuscation techniques.

Most variables are left undeclared to make things a bit more complicated.

The third function, which is also obfuscated using the JavaScript Compressor, builds a PowerShell downloader that downloads and runs BadSpace backdoor silently in rundll32.exe after 10 seconds.

BadSpace is a sample of obfuscated PE32+ DLL with RC4-encrypted strings, DLL names, and API function names.

Each string has its length, a key, and encrypted data. APIs are dynamically resolved by LoadLibraryW and GetProcAddress.

IDA Python Script

A researcher has created an IDA Python script based on the OALabs Revil decryption script to decode strings and APIs in IDA.

In addition, a security analyst (Mohamed Ashraf) has provided another independent Python script for decrypting BadSpace strings.

BadSpace employs several anti-sandbox similarities, counting the number of folders in %TEMP% and %APPDATA%, querying the registry for “DisplayName” subkeys under SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, and checking the number of processors and global memory status.

Thresholds differ per sample, and after anti-sandbox checks, it creates a mutex with a unique UUID, which persists via scheduled task creation and self-copying for EXE or DLL files.

The backdoor uses a hardcoded RC4 key for encrypting C2 communication, which differs for each sample.

Its user agent is responsible for the “BadSpace” name, which includes extra spaces not found in Firefox user agents.

While “WarmCookie” appeared in one VirusTotal detection name, “BadSpace” was more prevalent in researcher discussions and on Twitter, leading to its adoption.