Google served me Malware

Summary of the video (technical malware/tech analysis)

The video describes a suspected Google Ads-driven malvertising incident that leads to a multi-stage phishing/malware infection chain. The host walks through how the advertiser click path is manipulated, how the landing page injects obfuscated JavaScript, and how the final payload is a backdoored version of legitimate TortoiseSVN using DLL side-loading (DLL hijacking) plus WebSocket-based C2.

---

1) Malvertising observed via Google Ads link manipulation

• The speaker reports an email with a subject related to malware distribution via Google Ads.
• When examining the email screenshot (via HTML inspection), the ad click/link contains unexpected URL concatenation, including:
  • A data-pcu-like HTML attribute that appears to include a URL to bing.com, but also contains an extra domain appended after a comma (e.g., bing.com, https://markov-chains.com...).
• The speaker attempts to reproduce the exact ad results but can’t because Google Ads are dynamic (varies by region/targeting).
• By inspecting and clicking the ad-like results, they monitor browser/network behavior and observe:
  • Traffic flows through Google ad services, then google.com/aclk (ads tracking),
  • but the ultimate landing destination involves an unexpected domain such as markov-chains.com.

---

2) Landing page and injected obfuscated JavaScript

• The landing page appears broken/empty (with hints consistent with WordPress presence, such as favicon/breadcrumbs).
• The speaker finds multiple injected <link rel="preload"> and script tags pointing to an unrelated domain, e.g.:
  • slgnahrfs.com/redandrandom.js
• Deobfuscation attempts using tools like WebCrack show:
  • the JavaScript remains largely a base64 blob, making it difficult to interpret.
• They identify an API endpoint/config hosted on domains containing patterns like “slgnr…” / “slgnrefs…”, which likely controls:
  • redirect logic, and/or
  • where the injected script sends the user.
• The host concludes the chain is plausible because it likely:
  • detects “you came from X” (referrer/visit context),
  • then redirects or loads an additional payload or lure (e.g., a fake login page).

---

3) Fake sign-in lure and credential-steering setup

• The video discusses redirecting to a fake Microsoft/Bing-style sign-in page (described as “Bing sign-in”, i.e., “fake”).
• The lure attempts to push the victim to download/run a “Microsoft security module”.
• The downloaded file is misleadingly named microsoft.bat (a batch script).

---

4) Batch → PowerShell stages (downloader/executor chain)

The .bat script:

• Uses PowerShell with execution policy bypass (-ExecutionPolicy Bypass)
• Uses retries/loops
• Downloads additional content using:
  • irm (Invoke-RestMethod)
• Executes it using:
  • iex (Invoke-Expression)

Stage progression described:

• Stage 2/3: PowerShell downloads more scripts/files from the same infrastructure and hides the console window using Win32 API calls (e.g., ShowWindow, GetConsoleWindow).
• Stage 3: downloads script.php and executes it.
• Stage 4: includes base64 + AES decryption, extracting key/IV/mode from decoded base64, then uses IEX to run decrypted stage content.
• Stage 5 / final payload: downloads an installer from a domain like hosting.iptusb.com.

---

5) Final payload is a backdoored legitimate tool (TortoiseSVN)

• The payload is an Inno Setup installer.
• The installer:
  • creates a scheduled task,
  • drops files,
  • writes a marker/flag to indicate it has already run,
  • sends victim metadata (hostname, username, country, time) to C2.
• The packaged file contents include many components resembling TortoiseSVN/TortoiseBlame.
• The speaker uses Inno unpacker tools to extract the installer and compares it to legitimate TortoiseSVN.
• Findings:
  • the malware contains a bundled rendition of genuine TortoiseSVN,
  • but it’s been tampered with.
• The standout technique:
  • DLL side-loading / DLL hijacking by replacing a DLL that the legitimate app loads.

---

6) C2 behavior and WebSocket command/control

In a sandbox run (Any.Run / dynamic analysis):

• Tortoise Blame.exe initiates suspicious activity.
• It connects to a remote endpoint using HTTP/WebSocket upgrade behavior, establishing a connection for interactive control.

The “smoking gun” (added after editing):

• the critical replaced DLL is named crshhndl.dll
• in the malicious package it is:
  • not signed
  • has a different timestamp than the legitimate signed DLL.

Additional details:

• The replaced DLL is identified as a .NET assembly (analyzed with ILSpy/.NET Peak-type tooling).
• The assembly contains a WebSocket connector and typical post-exploitation capabilities, including:
  • keyboard hook / input simulation
  • clipboard helper
  • screen capture
  • capture modes and other client-core modules
• The binary is heavily obfuscated using ConfuserEx / Confuser (noted in the narration as “Confused by Confuser Core”).

---

7) Attribution/context: Kratos / “fishing kit” references

• The speaker cross-checks “Web Kratos” references and points to content consistent with a phishing-as-a-service / social engineering kit.
• They mention Kratos administrative interface similarities and conclude the campaign aligns with known “fishing kit” patterns.

---

Key products/tools mentioned (analysis workflow)

• Inspect element / browser DevTools (HTML attribute analysis; network tracing)
• WebCrack (attempted JavaScript deobfuscation)
• CyberChef (mentioned as a possible decoding/decryption utility)
• REMnux (reverse engineering environment)
• Inno unpacker / Inno tools (extract Inno Setup installers)
• ILSpy / .NET Peak (inspect decompiled .NET assemblies)
• Any.Run (dynamic sandboxing)

---

Main speakers/sources

• Primary speaker: John (referred to as “John” in the video narrative; malware analyst narrating steps)
• Referenced parties/products: Vanta (video sponsor), plus various security tooling (WebCrack, Inno unpacker, ILSpy, Any.Run) as sources of analysis capability.