# EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware

**researchcenter.paloaltonetworks.com/2017/09/unit42-hoeflertext-popups-targeting-google-chrome-users-now-**
pushing-rat-malware/

Brad Duncan September 1, 2017

By [Brad Duncan](https://unit42.paloaltonetworks.com/author/bduncan/)

September 1, 2017 at 5:00 AM

[Category: Malware,](https://unit42.paloaltonetworks.com/category/malware-2/) [Unit 42](https://unit42.paloaltonetworks.com/category/unit42/)

Tags: [EITest,](https://unit42.paloaltonetworks.com/tag/eitest/) [HoeflerText,](https://unit42.paloaltonetworks.com/tag/hoeflertext/) [RAT](https://unit42.paloaltonetworks.com/tag/rat/)

The attackers behind the EITest campaign have occasionally implemented a social
engineering scheme using fake HoeflerText popups to distribute malware targeting users
of Google's Chrome browser. In recent months, the malware used in the EITest campaign
[has been ransomware such as Spora and](http://malware-traffic-analysis.net/2017/05/17/index.html) [Mole. However, by late August 2017, this](http://malware-traffic-analysis.net/2017/07/23/index.html)
campaign began pushing a different type of malware. Recent samples are shown to infect
Windows hosts with the NetSupport Manager remote access tool (RAT). This is significant,
because it indicates a potential shift in the motives of this adversary. Today's blog reviews
recent activity from these EITest HoeflerText popups on August 30, 2017 to discover more
about this recent change.

Figure 1 below shows what victims see when they view a compromised website, and Figure
2 shows the page if the user clicks the "Update" button. Chrome users should be suspicious
of any pop-ups that match these images.


-----

_Figure 1: Fake HoeflerText popup after viewing a compromised site with the Chrome_
_browser._

_Figure 2: Clicking the "update" button sent us Font_Chrome.exe._

## History

[As early as December 2016, the EITest campaign began using HoeflerText popups to](https://www.proofpoint.com/us/threat-insight/post/EITest-Nabbing-Chrome-Users-Chrome-Font-Social-Engineering-Scheme)
[distribute malware. Since late January 2017, we have only seen ransomware from these](http://malware-traffic-analysis.net/2017/01/30/index3.html)
popups. The method has occasionally disappeared for weeks at a time. By July 2017, the
HoeflerText popups [delivered Mole ransomware under the file name Font_Chrome.exe.](http://malware-traffic-analysis.net/2017/07/23/index.html)
These popups stopped in late July. But by late August 2017, they reappeared, and we saw a


-----

different type malware sent under the file name Font_Chrome.exe. Recent examples
reviewed by Unit 42 are not ransomware; they are file downloaders. Figure 3 below shows
the hits on Font_Chrome.exe in AutoFocus from July 16, 2017 through August 30, 2017.

_Figure 3: Recent activity from fake HoeflerText popups in Google Chrome sending malware._

## Recent Activity

Network traffic follows two distinct paths. Victims who use Microsoft Internet Explorer as their
web browser will get a fake anti-virus alert with a phone number for a tech support scam.
Victims using Google Chrome as their browser will get a fake HoeflerText popup as seen in
Figure 1 that offers malware disguised as Font_Chrome.exe. Figure 4 shows the chain of
events for current activity from the EITest campaign.


-----

_Figure 4: Chain of events for activity from the EITest campaign._

Current samples of Font_Chrome.exe are file downloaders. They retrieve follow-up malware
that installs a NetSupport Manager remote access tool (RAT). NetSupport Manager is a
[commercially-available RAT previously associated with a malware campaign from hacked](http://www.netsupportmanager.com/index.asp)
Steam accounts last year. For the August 2017 HoeflerText popups, we have found two
examples of the file downloader and two examples of follow-up malware to install NetSupport
Manager RAT.


-----

_Figure 5: Traffic from a recent infection filtered in Wireshark._

_Figure 6: The downloaded fake Chrome font program._


-----

_Figure 7: Double-clicking Font_Chrome.exe downloads and executes more malware._


-----

_Figure 8: Follow-up malware installs NetSupport Manger RAT on the infected Windows host._


-----

_Figure 9: RAT configuration settings from an infected Windows host._

NetSupport Manager is currently at version 12.5. The version seen on the infected host was
version 11.00.

## Conclusion

Users should be aware of this ongoing threat. Be suspicious of popup messages in Google
Chrome that state: The "HoeflerText" font wasn't found. Since this is a RAT, infected users
will probably not notice any change in their day-to-day computer use. If the NetSupport
Manager RAT is found on your Windows host, it is probably related to a malware infection.

It's yet to be determined why EITest HoeflerText popups changed from pushing ransomware
to pushing a RAT. Ransomware is still a serious threat, and it remains the largest category of
malware we see on a daily basis from mass-distribution campaigns. However, we have also
noticed an increasing amount of other forms of malware in recent campaigns, especially
compared to 2016. RATs give attackers more capabilities on a host and are generally much
more flexible than malware designed for a single purpose. The August 2017 change by
EITest HoeflerText popups represents a subtle shift where ransomware is slightly less
prominent than it once was.

See the section below for file names, locations, hashes, and other related information on
today's infection. Palo Alto Networks customers are protected from this threat through our
[next-generation security platform Current samples appear as malware in AutoFocus and](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/autofocus)


-----

[customers can search for similar malware using the NetSupportManager tag.](https://autofocus.paloaltonetworks.com/#/tag/Unit42.netsupportmanager)

We will continue to investigate this activity for applicable indicators, inform the community,
and further enhance our threat prevention platform.

## Indicators of Compromise

URLs and domains to block:

hxxp://demo.ore.edu[.]pl/book1.php
boss777[.]ga
pudgenormpers[.]com
invoktojenorm[.]com
hxxp://94.242.198[.]167/fakeurl.htm
hxxp://94.242.198[.]168/fakeurl.htm

First file downloader and follow-up malware:

SHA256:
[23579722efb0718204860c19a4833d20cb989d50a7c5ddd6039982cf5ca90280](https://www.reverse.it/sample/23579722efb0718204860c19a4833d20cb989d50a7c5ddd6039982cf5ca90280?environmentId=100)
File size: 168,905 bytes
File name: Font_Chrome.exe
File description: Malware downloader

SHA256:
[8cbbb24a0c515923293e9ff53ea9967be7847c7f559c8b79b258d19da245e321](https://www.reverse.it/sample/8cbbb24a0c515923293e9ff53ea9967be7847c7f559c8b79b258d19da245e321?environmentId=100)
File size: 2,665,634 bytes
File location: C:\Users\[username]\AppData\Local\temp\[9 random characters].jpg.exe
File location: hxxp://boss777[.]ga/HELLO.exe
File description: Follow-up malware that installs NetSupport Manager RAT

Second file downloader and follow-up malware:

SHA256:
[463bef675e8e100eb30aeb6de008b9d96e3af6c3d55b50cc8a4736d7a11143a0](https://www.reverse.it/sample/463bef675e8e100eb30aeb6de008b9d96e3af6c3d55b50cc8a4736d7a11143a0?environmentId=100)
File size: 169,796 bytes
File name: Font_Chrome.exe
File description: Malware downloader

[SHA256: 8188732c8f9e15780bea49aced3ef26940a31c18cf618e2c51ae7f69ef53ea10](https://www.reverse.it/sample/8188732c8f9e15780bea49aced3ef26940a31c18cf618e2c51ae7f69ef53ea10?environmentId=100)
File size: 2,665,612 bytes
File location: C:\Users\[username]\AppData\Local\temp\[9 random characters].jpg.exe
File location: hxxp://boss777[.]ga/joined1.exe
File description: Follow-up malware that installs NetSupport Manager RAT


-----

Associated URLs:

46.248.168[.]49 port 80 - demo.ore.edu[.]pl - GET /book1.php
51.15.9[.]99 port 80 - boss777[.]ga - GET /HELLO.exe
51.15.9[.]99 port 80 - boss777[.]ga - GET /joined1.exe
51.15.9[.]99 port 80 - boss777[.]ga - POST /JS/testpost.php
DNS query for pudgenormpers[.]com, resolved to 94.242.198[.]167
DNS query for invoktojenorm[.]com, resolved to 94.242.198[.]168
94.242.198[.]167 port 1488 - POST hxxp://94.242.198[.]167/fakeurl.htm
94.242.198[.]168 port 1488 - POST hxxp://94.242.198[.]168/fakeurl.htm

Directories seen so far for NetSupport Manager RAT on an infected host:

C:\Users\[username]\AppData\Roaming\AppleDesk1
C:\Users\[username]\AppData\Roaming\AppleDesk2

**Get updates from**
**Palo Alto**
**Networks!**

Sign up to receive the latest news, cyber threat intelligence and research from us

[By submitting this form, you agree to our Terms of Use and acknowledge our Privacy](https://www.paloaltonetworks.com/legal-notices/terms-of-use)
Statement.


-----