DeerStealer Rootkit Stealer Campaign: Infrastructure and Defense

In the ever-evolving landscape of cybersecurity threats, one of the most concerning emerging threats is the DeerStealer Rootkit Stealer Campaign. This sophisticated form of malware leverages a variety of techniques to evade detection and steal sensitive information from targeted systems. As part of the infrastructure that supports this attack, cybercriminals rely on specific domains, IPs, and file hashes that can be tracked and blocked to help mitigate the attack’s effectiveness.

In this blog post, we’ll present an infrastructure map of the DeerStealer Rootkit Stealer Campaign, focusing on its various attack vectors, and provide a table of Indicators of Compromise (IOCs) that organizations can use to detect and block this threat in real time.

Understanding the DeerStealer Rootkit Stealer Campaign

The DeerStealer Rootkit Stealer is a sophisticated malware variant that utilizes multiple advanced techniques to infiltrate systems, hide its presence, and exfiltrate valuable information. Rootkits, in general, are malicious software components designed to provide persistent, stealthy access to an infected machine. What sets DeerStealer apart is its specific targeting of credential theft, its ability to hide under the radar, and its exploitation of both local and remote infrastructure.

Rootkit Characteristics and Capabilities

Persistence: Once installed, DeerStealer ensures its continued presence on the infected system by embedding itself deeply within the operating system, often using techniques such as kernel-mode rootkits. This makes it very difficult to detect using traditional security tools, which primarily focus on user-space processes.

Keylogger Functionality: DeerStealer is capable of monitoring user activity, capturing keystrokes, and stealing login credentials for various applications, especially browsers and email clients. These credentials are crucial for the attacker to access bank accounts, corporate networks, and other sensitive information.

C2 Communication: One of the hallmark features of DeerStealer is its reliance on Command and Control (C2) servers, which are used to manage infected machines, receive stolen data, and issue further commands to the compromised systems.

The campaign is organized into multiple stages:

Initial Access – The attacker typically gains access via phishing emails, exploiting vulnerabilities in software, or using social engineering tactics.

Payload Execution – Once access is gained, the malware installs itself and connects back to its C2 infrastructure.

Data Exfiltration – The stolen credentials and sensitive data are exfiltrated to remote locations, typically using encrypted or obfuscated communication methods.

Command and Control Communication – The malware regularly communicates with its C2 infrastructure, downloading additional payloads and ensuring persistence on the infected machine.

DeerStealer’s Infrastructure and Attack Vector

The DeerStealer Rootkit Stealer Campaign involves several layers of infrastructure, each designed to further the attacker’s ability to compromise, monitor, and control infected systems. These components include malicious domains, IP addresses, and file hashes, all of which are associated with the malware’s various stages of operation. Let’s take a deeper look at the technical aspects of this infrastructure:

Malicious Domains

The DeerStealer Rootkit Stealer relies heavily on custom malicious domains for various purposes, including:

C2 Server Communication: The malware uses these domains to establish an encrypted communication channel with the C2 server, allowing attackers to issue commands, receive stolen data, and deploy additional payloads.

Data Exfiltration: Sensitive information, including user credentials, is exfiltrated to these domains, where it is processed and then likely sold or used for other malicious purposes.

These domains are often chosen because they can be registered anonymously and can quickly be abandoned or moved, making them harder to track and block. Attackers frequently change domains, making it critical to stay updated with threat intelligence feeds to maintain detection capabilities.

Malicious IPs

The IP addresses associated with DeerStealer’s C2 servers are critical to understanding the infrastructure behind this malware. These IPs are often used for:

Command and Control Channels: These IPs allow the attacker to send commands to the infected machine, instructing it to download or upload data, further payloads, or maintain persistence on the system.

Exfiltration: Stolen credentials and sensitive data are often transmitted via these IPs to ensure the attacker maintains access and control over the compromised network.

By analyzing network traffic and correlating it with known malicious IPs, defenders can block these communication channels and sever the attack’s ability to operate.

Malicious File Hashes

One of the most critical aspects of defending against the DeerStealer Rootkit Stealer campaign is identifying and blocking malicious files using their file hashes. These hashes represent the unique identifiers for the files associated with the malware, ensuring that specific malicious binaries are detected and removed, even if the malware attempts to change its file name.

Malicious files often have embedded functionality such as:

Credential Stealing Mechanisms: These files contain the malicious code used to interact with browsers and steal stored credentials.

Persistence Mechanisms: These files ensure the malware remains undetected and active on the system even after reboots or system scans.

By monitoring file hashes and utilizing endpoint detection tools, organizations can ensure these files are quickly flagged and quarantined, reducing the risk of infection.

Indicators of Compromise (IOCs) for Blocking DeerStealer

To help organizations prevent and mitigate the impact of the DeerStealer Rootkit Stealer Campaign, it is essential to block the following Indicators of Compromise (IOCs). The table below lists the File Hashes, IP Addresses, and Domains associated with the malware:

How to Defend Against the DeerStealer Rootkit Stealer Campaign

Blocking the IOCs listed above is a crucial step in defending against the DeerStealer Rootkit Stealer campaign. However, there are additional best practices that organizations should implement to further protect their infrastructure:

Network Segmentation: Ensure that sensitive systems are isolated from general network traffic to prevent lateral movement of malware.

Endpoint Protection: Use advanced endpoint detection and response (EDR) tools to detect and respond to suspicious behavior.

Regular IOC Updates: Continuously monitor and update IOC lists to ensure that any new threats associated with DeerStealer are blocked.

Email and Web Filtering: Implement robust email and web filters to prevent phishing attacks and drive-by downloads from malicious websites.

User Awareness Training: Educate users on the dangers of clicking on unknown links and downloading attachments from suspicious sources.

Conclusion

The DeerStealer Rootkit Stealer campaign is an evolving and dangerous threat to organizations worldwide. By mapping the infrastructure behind these attacks, blocking key IOCs, and implementing strong defensive measures, companies can reduce the risk of falling victim to these sophisticated cybercriminal tactics.

Stay vigilant, regularly update your threat intelligence feeds, and ensure your security infrastructure is ready to detect and defend against this and other emerging threats.

Let us help you safeguard your environment. Contact us today for a comprehensive security review and a tailored defense strategy against advanced threats like DeerStealer.