Advanced Persistent Adware: IsErik
This advisory is the result of analysis conducted by threat-intelligence analysts following the identification of a security anomaly during delivery of Managed Detection and Response (MDR) services.
Specifically, the anomaly detected is associated with a particularly invasive and persistent adware-type software: ADWARE IsErIk.
This threat, categorized as Advanced Persistent Adware, is frequently disguised as “portable” versions of commercial products or as license key generators (keygen) for commercial applications. In certain cases the software requests user permission to install additional software, causing command execution on the target machine.
System infection occurs through creation of a scheduled task designed to execute Javascript code via WScript. During incident response operations, the task name was identified as \Secured Yahoo Powered nalel, used for execution of the command:
C:\Windows\system32\wscript.exe "C:\ProgramData\{38E1FD82-B2A3-7744-3465-XXXXXXX}\tano.txt" "687474XXXXXXX636f6d" "433a5c50XXXXX237363243387d5c726572656669" "433a5c50726XXXXXXXX237363243387d5c7269646f746f64" "//B" "//E:jscript" "--IsErIk"`,
which, after verifying the presence of the --IsErIk parameter, decodes the remaining parameters and connects to the command-and-control server (in this case the URL hxxps://ddukmql[.]com) and performs POST requests, whose responses consist of additional Javascript code to be executed on the compromised system.
Indicators of Compromise
SHA256
- 2b89075ad9485d72bcf6548afaee7ba8d4fa0f77e874d62efd70c9c311dc406d (C:\ProgramData{38E1FD82-B2A3-7744-3465-E906AE2762C8}\tano.txt)
File Path
- C:\ProgramData{38E1FD82-B2A3-7744-3465-E906AE2762C8}\tano.txt
- C:\ProgramData{89F74C94-03B5-C652-8573-58101F31D3DE}\tofi.txt
- C:\ProgramData{F4723111-7E30-BBD7-F8F6-259562B4AE5B}\rari.txt
- C:\ProgramData{595E9C3D-D31C-16FB-55DA-88B9CF980377}\fala.txt
- C:\ProgramData{19B7DCD4-93F5-5612-1533-C8508F71439E}\faso
- C:\ProgramData{F3BF36DC-79FD-BC1A-FF3B-22586579A996}\doro
Domains
- ddukmql[.]com
- katunaq[.]com
- tdfpa[.]com
- qajolos[.]com
- butapujo[.]com
- rududulu[.]com