iTranslator Malware Installs Two Drivers to Perform a MitM Attack

Minimalist · Oct 13, 2018

According to FortiGuard Labs, the malware sample, called itranslator_02.exe, is signed by a digital certificate that expired back in 2015.

This instance starts off by creating a folder called “itranslator” in the program-data folder and extracting a file named wintrans.exe into that folder. The file initializes by installing iTranslatorSvc, a driver that enables the malware to load at system startup. Next, wintrans.exe installs another driver called “iNetfilterSvc” before downloading “iTranslator.dll.”
Click to expand...

https://securityintelligence.com/ne...nstalls-two-drivers-to-perform-a-mitm-attack/

Rasheed187 · Oct 13, 2018

Tricky stuff, that's why you should only allow fully trusted apps to install drivers. A translator should not need to load any driver anyway.

Log in or Sign up

iTranslator Malware Installs Two Drivers to Perform a MitM Attack

Minimalist Registered Member

Rasheed187 Registered Member

Log in or Sign up

iTranslator Malware Installs Two Drivers to Perform a MitM Attack

Minimalist Registered Member

Rasheed187 Registered Member

Useful Searches