MadMxShell Backdoor Spreads Through Malicious Ads
A recent malvertising campaign abusing Google Ads involves a series of websites resembling a legitimate IP scanner tool, aiming to distribute a new backdoor named MadMxShell. Researchers from Zscaler ThreatLabz found that the attackers registered numerous similar domains using typosquatting tactics. They utilized Google Ads to promote these domains, exploiting specific search terms to attract visitors. Approximately 45 domains were created between November 2023 and March 2024, posing as various software tools like Advanced IP Scanner and ManageEngine. This marks the first instance where such a method has been used to spread a complex Windows backdoor.
Initial Attack Starts With Malicious JavaScript
Victims searching for these tools are directed to deceptive websites containing JavaScript code that triggers the download of a malicious file ("Advanced-ip-scanner.zip"). Inside the ZIP file are two files: "IVIEWERS.dll" and "Advanced-ip-scanner.exe." The latter employs DLL side-loading to initiate the infection process. The DLL then injects shellcode into the EXE file via process hollowing, which unpacks additional files – "OneDrive.exe" and "Secur32.dll." The legitimate OneDrive.exe is abused to load Secur32.dll and execute the shellcode backdoor, while also establishing persistence and disabling Microsoft Defender Antivirus.
MadMxShell Backdoor Comes With Diverse Toolkit
The backdoor, named for its use of DNS MX queries for command-and-control (C2), has capabilities such as gathering system information, executing commands, and managing files. It communicates with the C2 server ("litterbolo[.]com") using DNS tunneling, employing various techniques to evade security measures, including multiple stages of DLL side-loading and anti-dumping methods.
Though the origin and motives of the malware operators remain unclear, Zscaler discovered two accounts associated with them on underground forums, created using the email address wh8842480@gmail[.]com. These forums have seen discussions related to setting up Google AdSense threshold accounts, hinting at the attackers' interest in a prolonged malvertising campaign.
