Attack process - how PLAYFULGHOST Malware is distributed and what it attacks

Google's Managed Defense team and security researcher Tatsuhiko have uncovered PLAYFULGHOST, a sophisticated backdoor malware that evolved from the Gh0st RAT remote administration tool, whose source code was leaked in 2008.

This malware variant demonstrates extensive capabilities for system compromise and data exfiltration.

Distribution Methods: The malware spreads through two primary attack vectors:

1. Phishing Campaigns: Attackers distribute malicious RAR archives disguised with .jpg extensions, using "code of conduct" themed lures. A "code of conduct" themed lure typically refers to phishing emails that impersonate HR/management communications about workplace policies or conduct violations. These might claim the recipient needs to review updated policies or respond to a reported violation. The goal is often to create urgency and concern that compels clicking malicious links or attachments. When victims extract and execute these files, they trigger the download of PLAYFULGHOST from remote servers.
2. SEO Poisoning: The threat actors bundle the malware with legitimate applications, particularly LetsVPN, and manipulate search engine results for their hosted version to appear as genuine downloads. The trojanized installers subsequently deploy additional malicious executables that fetch PLAYFULGHOST components.

The malware utilizes techniques,where a legitimate executable loads a malicious DLL that then decrypts and injects the PLAYFULGHOST payload into memory. In a more complex scenario, the attackers use a Windows shortcut (QQLaunch.lnk) that combines two files named "h" and "t" to construct the malicious DLL, which is then side-loaded using a renamed version of curl.exe.

Persistence Mechanisms: The malware establishes persistence through multiple methods and then uses extensive surveillance and system manipulation features:

• Data Collection Capabilities:
  • Keylogging
  • Screen capture
  • Audio recording
  • System metadata harvesting
  • QQ account information extraction
  • Clipboard content monitoring
  • Security product enumeration
• System Manipulation Features:
  • Remote shell access
  • Additional payload deployment
  • Mouse and keyboard input blocking
  • Windows event log clearing
  • Clipboard data wiping
  • Browser cache and profile deletion
  • Messaging application data removal

The malware targets browsers like Chrome and Firefox and applications like Sogou, QQ, and 360 Safety to steal data from, combined with the use of LetsVPN as a lure. The targeted apps suggest the campaign primarily targets Chinese-speaking Windows users.