Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Domains/URLs

https://chatgpt.com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6

https://chatgpt.com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6

https://sites.google.com/view/antibot172881

http://1614733393/s/50d6565cf39e

http://1614733393/app/50d6565cf39e/IconEdit2Turb.msi

http://1614733393/app/afafa98279c9/ISOSimple.msi

http://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution.msi

IP Address

45.140.205.28

96.62.224.81

Hash

14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335

c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7

6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc

e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb

b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe

eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764

9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d

54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31

e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b

20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53

ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907

278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48

91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2

22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4

0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f

3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621

b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4

a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6

d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e

d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90

Filepaths

%LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader\

%LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool\

Detection Query 1 :

domainname like "https://sites.google.com/view/antibot172881" or url like "https://sites.google.com/view/antibot172881" or siteurl like "https://sites.google.com/view/antibot172881" or domainname like "https://chatgpt.com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6" or url like "https://chatgpt.com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6" or siteurl like "https://chatgpt.com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6" or domainname like "https://chatgpt.com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6" or url like "https://chatgpt.com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6" or siteurl like "https://chatgpt.com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6" or domainname like "http://1614733393/s/50d6565cf39e" or url like "http://1614733393/s/50d6565cf39e" or siteurl like "http://1614733393/s/50d6565cf39e" or domainname like "http://1614733393/app/50d6565cf39e/IconEdit2Turb.msi" or url like "http://1614733393/app/50d6565cf39e/IconEdit2Turb.msi" or siteurl like "http://1614733393/app/50d6565cf39e/IconEdit2Turb.msi" or domainname like "http://1614733393/app/afafa98279c9/ISOSimple.msi" or url like "http://1614733393/app/afafa98279c9/ISOSimple.msi" or siteurl like "http://1614733393/app/afafa98279c9/ISOSimple.msi" or domainname like "http://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution.msi" or url like "http://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution.msi" or siteurl like "http://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution.msi"

Detection Query 2 :

dstipaddress IN ("45.140.205.28","96.62.224.81") or srcipaddress IN ("45.140.205.28","96.62.224.81")

Detection Query 3 :

sha256hash IN ("e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb","91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2","9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d","eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764","b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe","a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6","0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f","22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4","3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621","6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc","278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48","b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4","14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335","c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7","54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31","e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b","20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53","ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907","d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e","d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90")

Detection Query 4 :

datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "%LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader\" or objectname like "%LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool\")

Detection Query 5 :

technologygroup = "EDR" and (objectname like "%LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader\" or objectname like "%LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool\")