Cybercriminals are leveraging the widespread interest in artificial intelligence to distribute malware, according to a recent analysis by FortiGuard Labs. Threat actors are creating malicious files that appear to be guides or resources related to AI, aiming to trick individuals searching for information on the technology.
These deceptive files, often distributed within ZIP archives, are designed to initiate a multi-stage attack chain. The initial lure might be a shortcut file that, when opened, executes a series of obfuscated commands. These commands are designed to extract hidden components from other files within the archive, which are marked with a "Hidden" attribute.
The attack chain involves several stages of script execution. An initial script, extracted from a file disguised as a PDF, sets up a hidden PowerShell process. This PowerShell script then searches for encrypted data within the same "PDF" file, identified by specific markers. Using a fixed password and deriving keys through PBKDF2, it decrypts the payload using AES-CBC.
The decrypted content is saved as another PowerShell script in a directory designed to mimic a legitimate Windows component, such as "Microsoft.WindowsSoundDiagnostics." This script further extracts additional components from the original "PDF" file, including a PowerShell script and a batch file, which are saved with names like "RealtekAudioService64.ps1" and "RealtekAudioService64.bat."
To ensure persistence, the malware establishes a scheduled task named "CheckRealtekAudioVersion." This task is configured to run the dropped batch file, masquerading as a Realtek audio service. The task is set up to execute shortly after infection and upon each subsequent user logon, employing privilege-aware settings and dual triggers.
The batch file, "RealtekAudioService64.bat," acts as a stealthy launcher for the main PowerShell payload. It first ensures it is running in a hidden mode, relaunching itself via PowerShell with hidden window settings if necessary. To evade detection, it reconstructs the string "powershell.exe" from split variables rather than referencing it directly. It also creates a timestamped log file, intended to appear as a diagnostic artifact, before executing the primary PowerShell script and then deleting the log to remove traces.
The core PowerShell script, "RealtekAudioService64.ps1," employs significant obfuscation techniques. It reconstructs all built-in PowerShell cmdlets from character arrays and uses variable names in Simplified Chinese, such as "$测试路径" and "$新建项目." This approach makes the script difficult for analysts to understand and helps bypass signature-based detection rules that rely on English cmdlet names. Directory paths and binary filenames are also hidden as Base64-encoded strings, decoded at runtime.
The ultimate goal of this complex infection chain is to deploy AsyncRAT, a .NET remote access trojan. This allows attackers to gain control over infected systems, enabling command-and-control communication and further malicious activities. The analysis suggests that the threat actors may have utilized AI tools during the development process, citing the structured coding style and the presence of Simplified Chinese variable names and comments alongside English text. This indicates a potential workflow where AI assists in code implementation, with the overall attack logic designed by human operators.
