Linkury adware caught distributing full-blown malware

guest · Sep 30, 2020

Linkury adware caught distributing full-blown malware
Linkury (SafeFinder) installations linked to infections with the Socelars and Kpot infostealer trojans
September 30, 2020
https://www.zdnet.com/article/linkury-adware-caught-distributing-full-blown-malware/

An adware family known primarily for distributing browser hijackers has been caught distributing full-blown malware, security researchers said today in a talk at the VirusBulletin 2020 security conference.

"What's dangerous about Linkury is how it uses its adware front as a gateway to propagate malware," said Arun Kumar Shunmuga Sundaram & Rajeshkumar Ravichandran, two malware analysts at Indian security firm K7 Computing.
"It has tailored its operations to cloak its malicious techniques and flies under the guise of 'legitimate, law abiding' adware, giving it recourse to plausible deniability of any wrongdoing."

While cyber-security companies like Malwarebytes, Microsoft, or Trend Micro are currently detecting Linkury operations as "adware," Sundaram and Ravichandran argue that "the case for flagging it as malware is strong based on the evidence presented in [their] paper."
Click to expand...

WHAT'S LINKURY?
Its main method of distribution is the SafeFinder widget, a browser extension ironically advertised as a way to perform safe searches on the internet.

The widget is usually bundled with other free apps as a secondary installer or is distributed via online ads that redirect internet users to SafeWidget download pages.
Installing the SafeFinder extension would usually changes a user's default browser search and home tab settings but also install additional binaries, different based on the user's country.
Click to expand...

Furthermore, K7 researchers also noted that the SafeFinder installer also contained many features specific to malware, such as PowerShell scripts to disable Windows Defender, and functions to detect when the installer was executed inside virtual machines and sandboxes, environments usually used for malware analysis — which it obviously wanted to avoid.

And last but not least, Linkury's SafeFinder widget had no intention of honoring user choices, with its installer specifically designed to install its payload even if the user tried to avoid the installation process, like pressing "No" as in the image below.
Click to expand...

Log in or Sign up

Linkury adware caught distributing full-blown malware

guest Guest

Log in or Sign up

Linkury adware caught distributing full-blown malware

guest Guest

Useful Searches