Daolpu: New Malware Exploits CrowdStrike Falcon Update Chaos

Following the recent events with the CrowdStrike Falcon update, a new threat has surfaced: cybercriminals are taking advantage of the confusion to distribute a malware disguised as a fix called Daolpu. 

Disguised as a recovery manual that claims to fix the update issues, this malware poses a serious risk to users globally. For a deep dive into the Falcon update and its aftermath, check out the full article here.

Here's what you need to know to protect your systems and data from this new possible fallout.

Spotting the Fake Recovery Manual

 

A new campaign is being run through phishing emails that pretend to be instructions for a Recovery Tool designed to fix Windows devices affected by the recent CrowdStrike Falcon crashes.

According to CrowdStrike the crooks are sharing a document called: ‘New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm,’.

When opened, the document shows a copy of a Microsoft support bulletin that instructs the reader on how to use the new Microsoft Recovery Tool - which should automatically delete the flawed CrowdStrike driver from the Windows PC.

 

Malicious document promoting new Windows recovery tool

 

How Daolpu Works?

 

While in originality, this document contains macros that, when enabled, download a base64-encoded DDL file from an external resource and drops it to '% TMP%mscorsvc.dll.'

The macros then uses Windows certutil to decode the base64-encoded DLL, which is executed to launch the Daolpu stealer on the compromised device. Daolpu terminates all running Chrome processes and then attempts to collect login data and cookies saved on Chrome, Edge, Firefox, and other Chromium browsers.

Reports confirm that it also targets Cốc Cốcm, a web browser primarily used in Vietnam, possibly indicating the malware's origin.

The stolen data is temporarily saved to '%TMP%\result.txt,' and then wiped after it's sent back to the attackers at their C2 server using the URL 'http[:]//172.104.160[.]126:5000/Uploadss'.

 

Malicious macros to install Daolpu stealer

 

Protective Measures

 

As of now, a guide on a dedicated fix for Daolpu malware is not widely available. However, some general protective measures include:

1. Make sure you only interact with CrowdStrike representatives through their official communication channels and follow their technical guidance.
2. Look for certificates of websites from which you download software to ensure they are legitimate.
3. Train users to avoid opening files from unknown or untrusted sources.
4. Adjust your browser settings to enable download protection that can warn you about potentially harmful websites or files.
5. Search for the file result.txt in the %TMP% directory, as its presence might indicate a Daolpu infection.

 

Daolpu is just the latest addition in a series of cyberattacks exploiting the chaos from the recent CrowdStrike Falcon update.

Alongside Daolpu, other malicious activities have emerged, including data wipers from the pro-Iranian hacktivist group 'Handala' and HijackLoader, which disguises the Remcos RAT as a CrowdStrike hotfix.

To stay ahead of emerging threats, look no further than RobustIT. Explore cybersecurity courses and solutions at RobustIT Training and Cyber Webinar.