What We Do
How We Do
Get Started

FakeBat Continues Signed MSIX App Package Abuse

BY eSentire Threat Response Unit (TRU)

August 1, 2023 | 6 MINS READ


Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?


Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

This blog was updated in September 2023 based on research from TRU that identifies this as FakeBat. This blog originally identified this threat as FakeBat.

What did we find?

In July, the eSentire Threat Response Unit (TRU) identified multiple FakeBat cases investigated by our SOC team. In these cases, the victims fell for suspected malicious advertisements impersonating Zoom and TradingView after performing web searches for these products.

The victims had then downloaded malicious MSIX installer files (such as Zoom-x64.msix) which attempted to infect their systems with Redline Stealer and SectopRAT. These were the first such observations in our telemetry since May 2023. Our analysis here will focus on discovering imposter websites and MSIX samples currently being used in FakeBat campaigns.

FakeBat Imposter Sites Registered on June - July 2023

TRU identified several suspected FakeBat payload sites hosted on IP registered in June and July 2023:

The domain names suggest an array of brands are impersonated in these attacks, including Microsoft, Zoom, Adobe, Steam, OpenAI, etc. (a more complete list can be found at the end of this blog). These brands have been used historically in previous FakeBat attacks, and landing pages comprise of an imposter download page for these products.

When visited manually, these sites present empty content or 403 HTTP errors, and successful recreation of infection chains has been minimal thus far. This may suggest operators may have improved the cloaking of these sites to evade discovery by researchers and scanners.

We did identify one successfully rendered page for Steam (store-steampowered[.]net) submitted to Urlscan.io on June 6, which shows an imposter page for the gaming service. The website was registered the same day and served a legitimate Steam binary at the time.

Figure 1 Imposter page for Steam, retrieved from Urlscan.io.

We assess this site likely served Steam-x64.msix (md5: c37aee1ebad9b0f7bd2e7755a3133d0e) in mid-July 2023 shown in Figure 2 below.

Figure 2 MSIX app launch. File is signed and asks for elevated privileges.

FakeBat Continues to Abuse Signed MSIX Packages

As we covered in our May blog, MSIX files are a relatively new installer format designed for Windows 10 and above. It requires the package contents to be signed; a barrier intended to limit abuse by threat actors. Unfortunately, these code signing certificates do find their way into threat actor hands and can be acquired on underground forums for a fee.

In a February post on XSS forums, a suspected FakeBat operator vouched for a code signing service offered by another forum member by providing a screenshot of their previous transaction with this member:

Figure 3 Suspected FakeBat operator's image posted to XSS in February 2023. The image purports to be the purchase of a code signing certificate from another forum member.

It's highly probable that FakeBat operators are purchasing the required code signing certificates used in their campaigns from other threat actors.

The latest MSIX app packages reviewed by TRU contained content signed by IMPERIOUS TECHNOLOGIES LIMITED, a private limited company based out of the UK.

Figure 4 Steam-x64.msix digital signature.

The AppManifest shows the package was created with Advanced Installer version 20.2 configured with Russian-language settings.

When launched, the package executes with elevated privileges then executes an embedded PowerShell script then drops and executes a legitimate copy of the Steam installer as a decoy. The PowerShell script (“NEW_mormons_v1.ps1”, MD5: d87bc0bcfa1976ffa6a165545fb7ca62) contains a similar structure to prior samples, with some minor updates. It downloads Redline Stealer binary disguised as a jpg file (“czx.jpg”, MD5: d5a1d54158e110a8d9b0eea06d37e26f) from hxxps://tatmacerasi[.]com and SectopRAT/ArechClient (“zhelp.exe”, MD5: 3AC860860707BAAF32469FA7CC7C0192) from hxxps://fullpower682[.]store.

Additional details on the PowerShell script can be seen in the annotated image below.

Figure 5 PowerShell script "NEW_mormons_v1.ps1" with annotations.

Similarities with prior FakeBat samples include:

A May PowerShell sample for comparison:

Figure 6 May 2023 PowerShell sample. See https://www.esentire.com/blog/fakebat-impersonates-midjourney-chatgpt-in-drive-by-cyberattacks


SectopRAT is downloaded as an encrypted RAR archive and decrypted using 7zip (also downloaded). The SectopRAT payload (MD5: DD50DE3ACC26293986F40EB04F0F1A99) is written to AppData\Local\Temp\ and injected into MsBuild.exe. It retrieves its C2 configuration from Pastebin and connects to 194.26.135[.]180 for command and control.

Figure 7 SectopRAT seen in debugging tool showing the ScanDetails class and various properties related to information collected from the target system.

Redline Stealer is loaded as assembly by PowerShell, with the resulting payload (MD5: D5A1D54158E110A8D9B0EEA06D37E26F) connecting to 194.26.135[.]119 port 12432 for command-and-control.

Figure 8 Snippet of Redline Stealer network traffic.

For a complete analysis of another Redline sample, read our Redline Stealer malware analysis.

How did we find it?

What did we do?

What can you learn from this TRU positive?

Recommendations from our Threat Response Unit (TRU):

Indicators of Compromise

Indicator Note

Suspected FakeBat Imposter Sites

623start[.]site FakeBat C2 (confirmed)
cdn-prok[.]site FakeBat C2 (suspected)
tatmacerasi[.]com Secondary Payload Host
fullpower682[.]store Secondary Payload Host
194.26.135[.]180 SectopRAT C2
194.26.135[.]119 Redline C2
C37AEE1EBAD9B0F7BD2E7755A3133D0E Steam-x64.msix
D87BC0BCFA1976FFA6A165545FB7CA62 NEW_mormons_v1.ps1
D5A1D54158E110A8D9B0EEA06D37E26F czx.jpg
3AC860860707BAAF32469FA7CC7C0192 zhelp.exe
DD50DE3ACC26293986F40EB04F0F1A99 SectopRAT
D5A1D54158E110A8D9B0EEA06D37E26F Redline
eSentire Unit
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire