Exposing FakeBat loader: distribution methods and adversary infrastructure
released on 2024-07-02 @ 08:33:34 AM
During the first semester of 2024, FakeBat (aka EugenLoader, PaykLoader) was one of the most widespread loaders using the drive-by download technique. Researchers uncovered multiple FakeBat distribution campaigns leveraging malvertising, software impersonation, fake web browser updates, and social engineering schemes on social networks to trick users into downloading the malware. Analysts monitored the FakeBat C2 infrastructure and identified over 130 domain names associated with high confidence to the FakeBat C2 servers since August 2023. The report provides IoCs, YARA rules and tracking heuristics to monitor the FakeBat distribution and C2 infrastructures.