BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads

Mar 11, 2023Ravie LakshmananCyber Threat Intelligence

The malware downloader known as BATLOADER has been observed
abusing Google Ads^[1]
to deliver secondary payloads like Vidar Stealer and Ursnif.

According to cybersecurity company eSentire^[2], malicious ads are used
to spoof a wide range of legitimate apps and services such as
Adobe, OpenAPI’s ChatGPT, Spotify, Tableau, and Zoom.

BATLOADER^[3], as the name suggests,
is a loader that’s responsible for distributing next-stage malware
such as information stealers, banking malware, Cobalt Strike, and
even ransomware.

One of the key traits of the BATLOADER operations is the use of
software impersonation tactics for malware delivery.

This is achieved by setting up lookalike websites that host
Windows installer files masquerading as legitimate apps to trigger
the infection sequence when a user searching for the software
clicks a rogue ad on the Google search results page.

These MSI installer files, when launched, execute Python scripts
that contain the BATLOADER payload to retrieve the next-stage
malware from a remote server.

This modus operandi marks a slight shift from the previous
attack chains^[4]
observed in December 2022, when the MSI installer packages were
used to run PowerShell scripts to download the stealer malware.

Other BATLOADER samples analyzed by eSentire have also revealed
added capabilities that allow the malware to establish entrenched
access to enterprise networks.

“BATLOADER continues to see changes and improvement since it
first emerged in 2022,” eSentire said.

“BATLOADER targets various popular applications for
impersonation. This is no accident, as these applications are
commonly found in business networks and thus, they would yield more
valuable footholds for monetization via fraud or hands-on-keyboard
intrusions.”