Threat Actor Distributes Python-Based Information Stealer Using a Fake Falcon Sensor Update Lure

Summary

On July 23, 2024, CrowdStrike Intelligence identified a malicious ZIP file containing a Python-based information stealer now tracked as Connecio. A threat actor distributed this file days after the July 19, 2024, single content update for CrowdStrike’s Falcon sensor — which impacted Windows operating systems — was identified and a fix was deployed. The ZIP file uses the filename CrowdStrike Falcon.zip in an attempt to masquerade as a Falcon update. CrowdStrike Intelligence does not currently attribute the analyzed activity to any named adversary.

Technical Analysis

Technical analysis is based on the ZIP archive (SHA256 hash: 5ba542fcfa45d50c0d65dda4dbbd7a28f737a2fc53841ddaab7f68ae1cdf5183) that was uploaded to a public malware repository on 2024-07-23 12:09 UTC with the filename CrowdStrike Falcon.zip. This archive contains the files shown in Table 1.

Table 1. Archive CrowdStrike Falcon.zip content

The file CrowdStrike Falcon.exe is a self-extracting RAR (SFX) that contains and executes a Python-compiled executable; this executable contains the Connecio information stealer.

The text file Readme.txt contains instructions for potential victims to disable Windows Defender and execute the malicious executable present in the archive (Figure 1).

Figure 1. Readme.txt content

Upon execution, the malicious file CrowdStrike Falcon.exe unpacks and invokes an information stealer written in the Python programming language that collects system information, the system’s external IP address (by making an HTTP GET request to the URL http[:]//ipinfo[.]io/[]?token=7fb82f5925fe8b), and data from multiple web browsers.

Then, the information stealer resolves its command-and-control (C2) servers by making HTTP GET requests to the Pastebin dead-drop URLs shown in Table 2.

¹ https[:]//pypi[.]org/project/pyperclip/

Table 2. Pastebin dead-drop URLs

Recommendations

These recommendations can be implemented to help protect against the activity described in this report.

• Only accept updates delivered through CrowdStrike official channels and adhere to CrowdStrike support teams’ technical guidance
• Train users to avoid executing files from untrusted sources
• Check website certificates on the download page to ensure downloaded software originates from a legitimate source
• Use browser settings to enable download protection that can issue warnings regarding potentially harmful websites or downloads
• Block SMTP network connections to unknown servers when not required within the organization
• Block Pastebin web access when not required within the organization

Appendix

YARA Rule

This YARA rule detects common strings for the Connecio information stealer.

Falcon LogScale Queries

This Falcon LogScale query detects the activity described in this report.

Indicators of Compromise (IOCs)

This table details the IOCs related to the information provided in this report.

Table 3. IOCs

MITRE ATT&CK

This table details the MITRE ATT&CK® tactics and techniques described in this report.

Table 4. Described Connecio activity MITRE ATT&CK mapping

Cryptocurrency Addresses

The following table includes cryptocurrency addresses obtained from the dead-drop configuration URL.

Table 5. Connecio-related cryptocurrency addresses

Additional Resources

Read other blog posts from CrowdStrike Intelligence regarding the Falcon content issue:

• Falcon Sensor Content Issue from July 19, 2024, Likely Used to Target CrowdStrike Customers
• Likely eCrime Actor Uses Filenames Capitalizing on July 19, 2024, Falcon Sensor Content Issues in Operation Targeting LATAM-Based CrowdStrike Customers
• Threat Actor Uses Fake CrowdStrike Recovery Manual to Deliver Unidentified Stealer