Full Report
A spoofed Bitdefender site has been used in a malicious campaign distributing VenomRAT and other malware, according to DomainTools
Analysis Summary
# Tool/Technique: VenomRAT
## Overview
VenomRAT is a Remote Access Trojan (RAT) used to ensure remote and persistent access to compromised victim systems. It is part of a malware trio distributed via a fake Bitdefender download site.
## Technical Details
- Type: Malware family (RAT)
- Platform: Windows (Inferred from context of downloading executables for Windows)
- Capabilities: Remote access, persistence. Based on its lineage (Quasar RAT), it likely includes standard RAT functionalities like file management, keystroke logging, webcam/microphone access, and command execution.
- First Seen: Not explicitly stated, but mentioned in context of a recent campaign targeting users seeking antivirus software.
## MITRE ATT&CK Mapping
As a RAT focused on remote access and persistence, associated generic mappings include:
- TA0011 - Command and Control
- T1071 - Application Layer Protocol
- TA0003 - Persistence
- T1547 - Boot or Logon Autostart Execution
## Functionality
### Core Capabilities
- Establishing remote and persistent access to the victim's environment.
### Advanced Features
- Inherits capabilities from Quasar RAT (inferred), suggesting a feature-rich remote control mechanism.
## Indicators of Compromise
- File Hashes: N/A (Not provided in the text)
- File Names: Likely bundled within `StoreInstaller.exe` or executed alongside other components.
- Registry Keys: N/A (Not provided in the text)
- Network Indicators: Likely utilizes C2 communication channels typical of RATs. (None specified)
- Behavioral Indicators: Establishing remote shell/connection after initial execution.
## Associated Threat Actors
- Threat actors running the campaign distributing the malware trio (specific group name not provided).
## Detection Methods
- Signature-based detection for known VenomRAT hashes or strings.
- Behavioral detection looking for processes associated with remote desktop connections or unauthorized encrypted outbound traffic.
- YARA rules: N/A (Not provided in the text)
## Mitigation Strategies
- Implementing robust endpoint detection and response (EDR) capable of flagging RAT behavior.
- User education regarding spoofed software vendor sites (e.g., Bitdefender) to prevent initial download.
- Network monitoring for anomalous outbound connections indicative of C2 traffic.
## Related Tools/Techniques
- StormKitty (Used in conjunction)
- SilentTrinity (Used in conjunction)
- Quasar RAT (Inferred lineage)
***
# Tool/Technique: StormKitty
## Overview
StormKitty is a malware tool utilized by attackers to gather sensitive information, specifically targeting credentials and cryptocurrency wallet data. It is deployed as part of a three-stage malware package often initiated by a fake software installer.
## Technical Details
- Type: Malware family / Open-source Framework
- Platform: Windows (Inferred)
- Capabilities: Credential harvesting, cryptocurrency wallet data theft (stealing secrets/keys).
- First Seen: Not explicitly stated in the context of this specific campaign.
## MITRE ATT&CK Mapping
- TA0006 - Credential Access
- T1003 - OS Credential Dumping
- TA0010 - Data Exfiltration
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- Data gathering, specifically targeting stored credentials (e.g., saved passwords) and cryptocurrency wallet files/keys stored on the compromised machine.
### Advanced Features
- Being an open-source framework suggests flexibility and potentially sophisticated modules for interacting with specific applications storing sensitive data.
## Indicators of Compromise
- File Hashes: N/A
- File Names: Bundled with the main dropper, potentially running as a secondary process initiated by `StoreInstaller.exe`.
- Registry Keys: N/A
- Network Indicators: Likely exfiltrates collected data over C2 channels established by the controlling malware. (None specified)
- Behavioral Indicators: Enumeration of specific file paths related to browser profiles or crypto wallet directories.
## Associated Threat Actors
- Threat actors seeking immediate financial gain (due to crypto focus) or access for resale.
## Detection Methods
- Detection focused on unauthorized file access to credential stores (e.g., Windows Credential Manager, browser profile directories).
- Network detection for outbound communication potentially carrying stolen wallet seeds or passwords.
## Mitigation Strategies
- Using robust antivirus/EDR solutions.
- For crypto users: Storing wallet keys/seeds offline (air-gapped) rather than on systems frequently used for general browsing.
- Multi-factor authentication (MFA) where possible to limit the value of stolen credentials.
## Related Tools/Techniques
- VenomRAT (Used in conjunction)
- SilentTrinity (Used in conjunction)
***
# Tool/Technique: SilentTrinity
## Overview
SilentTrinity is an open-source framework included in this infection chain to facilitate stealthy data exfiltration and maintain long-term control over the compromised system, often used when attackers seek to operate undercover for extended periods.
## Technical Details
- Type: Malware family / Open-source Framework
- Platform: Windows (Inferred)
- Capabilities: Enables stealthy exfiltration of data and provides a mechanism for long-term, low-profile command and control (C2).
- First Seen: Not explicitly stated.
## MITRE ATT&CK Mapping
- TA0010 - Data Exfiltration
- T1048 - Exfiltration Over Alternative Protocol
- TA0011 - Command and Control
- T1573 - Encrypted Channel
## Functionality
### Core Capabilities
- Stealthy communication and data staging/exfiltration.
- Maintaining covert, long-term access.
### Advanced Features
- Its nature as an open-source framework implies modularity and customization, aiding attackers in evading detection over time.
## Indicators of Compromise
- File Hashes: N/A
- File Names: Component of the malware bundle started by `StoreInstaller.exe`.
- Registry Keys: N/A
- Network Indicators: Likely utilizes specific protocols or methods designed for low-and-slow communication to remain stealthy. (None specified)
- Behavioral Indicators: Low-volume, scheduled outbound network traffic; attempts to inject into legitimate processes for persistence.
## Associated Threat Actors
- Threat actors interested in prolonged system access, potentially for data staging or gaining value by selling access to other criminal groups.
## Detection Methods
- Behavioral monitoring looking for process injection patterns or unusual file write/read activities associated with data staging prior to exfiltration.
- Network anomaly detection focusing on low-volume, infrequent connections from endpoints.
## Mitigation Strategies
- Regular auditing of running processes and network connections.
- Application whitelisting to restrict unauthorized code execution paths that SilentTrinity might leverage.
## Related Tools/Techniques
- VenomRAT (Used in conjunction)
- StormKitty (Used in conjunction)
***
# Technique: Malicious Distribution via Spoofed Website and Bundled Malware
## Overview
This technique involves setting up a convincing but fraudulent website impersonating a legitimate cybersecurity vendor (Bitdefender) to trick users into downloading a legitimate-looking installer (`StoreInstaller.exe`) that secretly contains and deploys a multi-layered malware payload.
## Technical Details
- Type: Technique (Defense Evasion, Initial Access)
- Platform: Windows Users seeking legitimate software.
- Capabilities: Social engineering, masquerading, execution of multi-component malware payload.
- First Seen: Campaign discovered around May 28, 2025.
## MITRE ATT&CK Mapping
- TA0001 - Initial Access
- T1566 - Phishing
- T1566.002 - Spearphishing Link (If link distribution is implied)
- TA0005 - Defense Evasion
- T1036 - Masquerading
- T1036.005 - Match Legitimate Name or Location
## Functionality
### Core Capabilities
- Deception: Mimicking the Bitdefender download interface to lower user suspicion.
- Distribution: Hosting malicious files on legitimate third-party cloud services (Bitbucket and Amazon S3), bypassing typical perimeter security that might block downloads from unknown domains.
### Advanced Features
- Layered Payload Delivery: Executing three distinct malware tools (VenomRAT, StormKitty, SilentTrinity) simultaneously or sequentially from one initial file, maximizing compromise potential immediately upon execution.
## Indicators of Compromise
- File Hashes: N/A (Only the dropper `StoreInstaller.exe` is explicitly mentioned as the initial executable).
- File Names: `StoreInstaller.exe`
- Registry Keys: N/A
- Network Indicators: Downloads originating from Bitbucket and Amazon S3 domains hosting the malicious package.
- Behavioral Indicators: Execution pathway leading from `StoreInstaller.exe` to the installation/loading of VenomRAT, StormKitty, and SilentTrinity components.
## Associated Threat Actors
- Threat actors interested in wide-scale compromise for varied goals (access resale, data theft, persistent control).
## Detection Methods
- Web filtering to block access to the currently identified fake URL.
- EDR monitoring for the execution of `StoreInstaller.exe` followed by the startup of processes associated with RATs or credential stealers.
- Whitelisting of software installers; blocking execution from non-standard download sources (like S3 buckets or Bitbucket uploads used for this purpose).
## Mitigation Strategies
- Implementing strong DNS filtering and URL reputation checks.
- Ensuring users are trained to verify that downloads come directly from the vendor’s primary domain, not third-party links referenced on secondary sites.
- Utilizing application control to prevent execution of unknown executables.
## Related Tools/Techniques
- Use of legitimate cloud hosting providers (AWS S3, Bitbucket) by threat actors for C2 establishment or malware distribution.