ChromeLoader

Analysis

ChromeLoader is a browser hijacker capable of redirecting searches for popular search engines such as Google, Bing and Yahoo, sending search data to its C2, and adding and preventing users from uninstalling a malicious browser extension.

Our evolving understanding of an evolving threat

We began 2023 with a narrower view of ChromeLoader than most other reporting, opting to track the suspected delivery affiliate (Charcoal Stork) separate from the payload. Throughout 2022, we observed the malicious ChromeLoader browser extension frequently following Charcoal Stork initial access, often loaded via a persistent PowerShell command that would add the extension and restart the browser with the extension loaded. We also observed another Charcoal Stork payload, which we initially tracked as AdSearch, consisting of a NodeJS application installed into the AppData\Roaming folder, that would sometimes spawn the ChromeLoader extension PowerShell loader. Due to differences between the NodeJS application that installed the next stage, and the PowerShell commands used to load the malicious browser extension, we distinguished these two payloads as distinct activity clusters.

However, as this threat evolved throughout 2023, we were able to refine our understanding. In August 2023, we merged AdSearch with ChromeLoader to simplify tracking different variants of this evolving threat. The emergence of SmashJacker, a payload distinct from ChromeLoader but that also stemmed from Charcoal Stork initial access, led to our decision to continue tracking Charcoal Stork separately. Later in 2023 we also observed VileRAT being delivered by Charcoal Stork, and research from other vendors suggests several other payloads have been observed as well.

Technical details

In 2023, we observed ChromeLoader using several different file types. Early in the year, we saw Visual Basic Scripts leading to PowerShell. By mid-year, we were seeing EXE and MSI installers. The initial file, often a NSIS installer for EXE files or an Advanced Installer-created MSI, led to increasingly obfuscated NW.js (formerly node-webkit) applications including compiled JavaScript. The application, installed in C:\Users\<username>\AppData\Roaming\, established persistence through a LNK file placed in C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" or a registry key entry in "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.

For those not familiar, NW.js apps include many boilerplate runtime files, including a runtime binary named nw.exe, which is often renamed to match the name of the application. These files are not malicious on their own. You can think of it like python.exe executing a malicious .py file. The malicious code is typically stored in one or more script files included in the package. The most important files for finding the malicious code are the package.json and the file pointed to by the main: variable in that file. This file is often named index.html. The HTML has the malicious JavaScript code to execute. In more recent versions of ChromeLoader, the JavaScript runs compiled JavaScript via the win.evalNWbin function.

While the NW.js runtime binary is not malicious on its own, the application names used by ChromeLoader are often unique. The application is often named with one or more common words and installed as a subfolder of C:\Users\<username>\AppData\Roaming\. Throughout 2022 and the first half of 2023, the ChromeLoader NW.js runtime binary matched the name of the application, however as of September 2023, it began using the default filename nw.exe.

All of this NW.js activity sets the stage for installing a malicious browser extension that harvests and redirects search traffic, likely to fuel advertising, and prevents the user from modifying the extensions installed in their browser. Malicious browser extensions often fall lower on defenders’ priority lists, as most just serve up adware. However, the ability to read and redirect user searches and data entered in the browser can expose sensitive company information or allow for more effective phishing campaigns against the user. There is also no guarantee that more malicious code won’t be installed at a later date.