BundleBot malware steals sensitive information

The cybersecurity landscape has been recently shaken by the emergence of BundleBot, a sophisticated malware strain that leverages advanced .

NET file development techniques to facilitate the unauthorized extraction of sensitive information from compromised computers.

BundleBot malware

Certain sites impersonate Google Assistant, tricking victims into downloading a fake RAR file (“Google_AI.rar”) from legitimate cloud storage like Dropbox.

Once unzipped, it contains an executable file (“GoogleAI.exe”), which is a self-contained .NET app that embeds a DLL (“GoogleAI.dll”) responsible for retrieving a password-protected ZIP from Google Drive.

Discovered by Check Point, the BundleBot malware utilizes custom-made obfuscation and junk code to evade analysis successfully. This advanced threat possesses a wide array of capabilities, including data theft from web browsers, screenshot capture, Discord token acquisition, and the gathering of sensitive information from Telegram and Facebook accounts.

Additionally, Check Point found a similar sample that adopts HTTPS to exfiltrate data in the form of a ZIP archive to a remote server.

Another campaign recently discovered by Malwarebytes employs sponsored posts and compromised verified accounts to deceive users into downloading malicious Google Chrome extensions.

These rogue extensions are specifically crafted to pilfer Facebook login credentials. Disguised as a seemingly harmless Google Translate extension, their primary function is to gather sensitive data exclusively from Facebook accounts. To evade content security policies, the collected data is then transmitted through the Google Analytics API.

IOCS:

According to Check Point, the IOCs (Indicators of Compromise) associated with the threat are as follows