Untracked Nightmares The Threats Hiding Behind Commodity Inf...

src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md

@@ -586,6 +586,41 @@ The tracer’s network hooks reveal multi-layer C2 authentication without revers
 
 Because the tracer records complete requests (headers, bodies, destinations), you can replay the same traffic to pull payloads, dump Themida/VMProtect shells in memory, and extract Rhadamanthys configuration data at scale.
 
+## Fingerprint-gated PPI installer analysis
+
+Pay-per-install (PPI) loaders can place unrelated malware on the same endpoint while keeping the initial installer disposable. One documented operation encoded the victim's OS, browser, referrer, search query and public IP in a Base64 `click_id`; only structurally valid, fresh fingerprints reached the payload, while crawlers and stale replays received a legitimate-looking decoy or a broken link.<sup>[[25]](#references)</sup>
+
+### Reconstruct the delivery gate
+
+Preserve the complete redirect chain, query strings, referrer, user agent, source IP and timestamps before detonating the sample. Decode suspected tracking values locally; normalize URL encoding and missing Base64 padding first.<sup>[[25]](#references)</sup>
+
+```bash
+python3 - "$CLICK_ID" <<'PY'
+import base64, sys, urllib.parse
+v = urllib.parse.unquote(sys.argv[1])
+v += "=" * (-len(v) % 4)
+print(base64.urlsafe_b64decode(v))
+PY
+```
+
+- Compare requests carrying a fresh captured value with missing, malformed and expired values. Record every response body and redirect instead of assuming the decoy is the real landing page.<sup>[[25]](#references)</sup>
+- Replay from an instrumented browser that preserves the original navigation context. A standalone scanner may lose the expected referrer, browser identity, source IP or timing and never expose the malware path.<sup>[[25]](#references)</sup>
+- Treat the decoded search term and referrer as attribution pivots: they can connect SEO-poisoning pages, social-engineering content and otherwise unrelated disposable domains to one gate.<sup>[[25]](#references)</sup>
+
+### Triage chained Inno Setup offers
+
+An Inno Setup package with no normal application payload can still implement the loader entirely as compiled Pascal in its `[Code]` section and execute from a page event. In the observed chain, the unpacked temporary stage sent a tracking beacon and continued only when the server returned `ok` rather than `no`.<sup>[[25]](#references)</sup>
+
+- Trace installer-created `.tmp` executables and preserve them before cleanup. Log the beacon request and response, then patch the conditional branch or emulate the expected approval response in an isolated lab to reach the offer-deployment path.<sup>[[25]](#references)</sup>
+- Capture the full child-process command lines. Affiliate/campaign parameters can survive into each offer and provide a stronger clustering key than the frequently rebuilt loader hash.<sup>[[25]](#references)</sup>
+- Analyze every spawned offer as a separate intrusion: each child can have its own runtime, persistence, C2 protocol and objective. Do not stop after classifying the parent as adware or assume children sharing one loader belong to the same malware family.<sup>[[25]](#references)</sup>
+
+One downstream pattern is a forged Chromium Preferences MAC used to register an unpacked extension; the browser-specific mechanics are covered here.<sup>[[24]](#references)[[25]](#references)</sup>
+
+{{#ref}}
+../../pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md
+{{#endref}}
+
 ## AdaptixC2: Configuration Extraction and TTPs
 
 See the dedicated page:
@@ -790,4 +825,6 @@ When a transport module exposes generic verbs such as `get`, `send`, `upload`, `
 - [21] [Recovering Metadata from .NET Native AOT Binaries](https://blog.washi.dev/posts/recovering-nativeaot-metadata/)
 - [22] [YARA-X CLI commands](https://virustotal.github.io/yara-x/docs/cli/commands/)
 - [23] [Dynamic capa: Exploring Executable Run-Time Behavior with the CAPE Sandbox](https://cloud.google.com/blog/topics/threat-intelligence/dynamic-capa-executable-behavior-cape-sandbox/)
+- [24] [The Phantom Extension: Backdooring Chrome Through Uncharted Pathways](https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways.html)
+- [25] [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis)
 {{#include ../../banners/hacktricks-training.md}}