Digital Doppelgangers Anatomy of Evolving Impersonation Camp...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/
• Blog Title: Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT
• Suggested Section: Windows Hardening -> Windows Local Privilege Escalation -> Dll Hijacking

🎯 Content Summary

What the blog covers
Two tightly linked 2025 malware operations that mass‑register look‑alike domains to deliver Gh0st RAT to Chinese‑speaking users. The operators evolve from simple MSI droppers (Campaign Trio, Feb–Mar 2025) to an evasive, multi‑stage MSI/VBScript dropper with DLL side‑loading and cloud‑hosted payloads (Campaign Chorus, from May 2025).

Targeting and lures
• Audience: Chinese‑speaking users globally, including those seeking VPNs/secure messengers t...

🔧 Technical Details

Mass brand‑impersonation + traffic acquisition. Register thousands of look‑alike domains for popular apps, then drive victims via ads/SEO/social/email to convincing download portals that serve trojanized installers.

MSI CustomAction abuse. Hide a malicious CustomAction (e.g., LaunchApplication) that silently runs an embedded stage‑2 ([System Process]5.exe) during a normal GUI install. Use Orca to enumerate the CustomAction table and verify hidden executables.

Cloud redirection for delivery. Route landing pages to wave‑specific redirectors that fetch ZIP/MSI from public cloud buckets so downloads inherit cloud reputation and evade simple domain/IP blocklists.

VBScript dropper with split payloads. Store the next stage as multiple fragments inside the MSI’s .cab; an embedded VBScript concatenates and decrypts them (password stored in MSI/script) to reconstruct the PE, evading static detection that expe...

🤖 Agent Actions

I analyzed the repository structure and relevant content under Windows Hardening -> Windows Local Privilege Escalation and identified that the best place to add the technique described in the blog is the existing DLL Hijacking page. I reviewed the following files to ensure fit and style (5+ files):

• windows-local-privilege-escalation/dll-hijacking/README.md
• windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.md
• windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
• windows-local-privilege-escalation/com-hijacking.md
• windows-local-privilege-escalation/create-msi-with-wix.md
• windows-local-privilege-escalation/msi-wrapper.md

What I added

• A new case study section in the DLL Hijacking page documenting the malware technique described in the Unit 42 blog:
  • MSI CustomAction abuse (including VBScript CustomAction) that reconstructs and decrypts split payload fragments from MSI’s embedded CAB.
  • DLL side-loading via signed host wsc_proxy.exe loading a locally dropped wsc.dll to execute attacker code under a trusted process (T1574.001).
  • Practical analysis steps using Orca, msiexec/lessmsi for extraction, and what to look for in MSI tables and scripts.
  • A minimal DllMain example for wsc.dll and notes on using proxy DLL tools when exports are required.
  • Hunting/detection tips using Procmon/Sysmon events, and post-exec behaviors (e.g., Defender exclusions, Scheduled Tasks) to monitor.

References

• I added the Unit 42 blog link into the References section of the same file.

Files modified

• src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/README.md

No other files were changed, and all content was kept concise, technical, and aligned to HackTricks style.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Windows Local Privilege Escalation -> Dll Hijacking".

Repository Maintenance:

• MD Files Formatting: 909 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0