Pirated Software is All Fun and Games Until Your Computer becomes infected with Malware

guest · Feb 2, 2020

Pirated Software is All Fun and Games Until Your Data’s Stolen
February 2, 2020
https://www.bleepingcomputer.com/ne...s-all-fun-and-games-until-your-data-s-stolen/

It may be tempting to try to download the latest games or applications for free, but doing so will ultimately land you in a hotbed of trouble as your computer becomes infected with adware, ransomware, and password-stealing Trojans.

In the past, though, most of the unwanted programs that were installed were adware or browser extensions, and though definitely a nuisance, for the most part, they were not stealing your files or installing ransomware on your computer.
This has changed as software installer monetization companies have started to increasingly team up with ransomware and password-stealing Trojan developers to distribute their malware.
Passwords stolen through software cracks
Security researcher Benkøw has recently noticed that monetized installers pretending to be software cracks and key generators are now commonly installing password-stealing Trojans or remote access Trojans (RATs) when they are executed.
Click to expand...

Distributed via torrent sites, YouTube, and fake crack sites
To distribute these adware bundles, attackers will upload them to torrent sites, create fake YouTube videos with links to alleged license key generators, or create sites designed to just promote adware bundles disguised as software cracks.

While it may be tempting to download pirated software so that you do not have to pay for it, the risks far outweigh the reward.
BleepingComputer gets emails, Twitter DMs, and Facebook messages every day from people who were infected by the STOP ransomware after pirating software.
Click to expand...

It is just not worth it.
Click to expand...

guest · Apr 17, 2020

Valorant beta scam infects your PC with malware
A supposed key generator for the upcoming Valorant game installs malware instead
April 16, 2020
https://www.tomsguide.com/news/valorant-beta-keygen-malware

Another hot new game means another predictable malware scam. The hot new game is Valorant, an upcoming multiplayer shooter from League of Legends developer Riot Games.

This malware scam promises beta keys to prospective players, but installs a keylogger instead. The scam is easy to avoid, and easy to address — but it’s also easy to fall for, particularly if you’re caught up in the Valorant hype.
This information comes from Albert Zsigovits, a threat researcher for U.K.-based security firm Sophos.

Fake #RiotGames #Valorant game-key generators being distributed.It’s actually a stealer, stub grabs a 2nd stage keylogger from pastebin. @malwrhunterteam @JayTHL @PlayVALORANT pic.twitter.com/nXKzRc8W7O April 15, 2020
If you try to use the fake Valorant keygen, it will download a keylogger from Pastebin directly to your computer, then channel anything you type — including your usernames and passwords — back to a cybercriminal somewhere.
Click to expand...

Unfortunately, getting rid of the keylogger will have to be done after the fact. According to VirusTotal, only Kaspersky software seems to recognize the keylogger download page on Pastebin as malicious at present.
Click to expand...

guest · Dec 18, 2020

Ransomware masquerades as mobile version of Cyberpunk 2077
December 17, 2020
https://www.bleepingcomputer.com/ne...querades-as-mobile-version-of-cyberpunk-2077/

A threat actor is distributing fake Windows and Android installers for the Cyberpunk 2077 game that is installing a ransomware calling itself CoderWare.
To trick users into installing malware, threat actors commonly distribute them as gamer installers, cheats, and cracks for copyrighted software.

This week, Kaspersky malware analyst Tatyana Shishkova discovered an Android ransomware masquerading as a mobile version of the Cyberpunk 2077 game. The game was being distributed from a fake website impersonating the legitimate Google Play Store.
Windows version released in November
This ransomware is the same as one discovered by MalwareHunterTeam in November that was disguised as a Windows Cyberpunk 2077 installer. Like the Android version, this ransomware calls itself CoderWare but is a variant of the BlackKingdom ransomware.
Click to expand...

As you can see, when attempting to install copyrighted software for free, you face huge risks of malware infections. This risk is even more significant when you try to install Android apps from third-party app stores.
Click to expand...

guest · Aug 23, 2022

Pirated 3DMark benchmark tool delivering info-stealer malware
August 23, 2022

Cybersecurity researchers have discovered multiple ongoing malware distribution campaigns that target internet users who seek to download copies of pirated software.

The campaign uses SEO poisoning and malvertising to push malicious shareware sites high in Google Search results, promoting fake software along with cracks and product activation key generators.
Click to expand...

The software used for luring victims in the ongoing campaigns, according to Zscaler that discovered them, includes the following:

Adobe Acrobat Pro

3DMark

3DVista Virtual Tour Pro

7-Data Recovery Suite

MAGIX Sound Force Pro

Wondershare Dr. Fone

Click to expand...

In many cases, the malicious executables masquerading as the promised software installers are hosted on file hosting services, so the landing pages redirect victims to other services to download the files.

The redirection sites which deliver the malicious files have less fancy names and stand on “xyz” and “cfd” top-level domains.
Click to expand...

The downloaded files are archives containing a 1.3MB password-protected ZIP to evade AV scans and a TXT file with the password.
The size of the unpacked ZIP balloons to 600MB using byte padding is a common anti-analysis practice followed by many malware authors.

The contained executable is a malware loader that spawns an encoded PowerShell command that launches a Windows command prompt (cmd.exe) after a 10 seconds timeout to evade sandbox analysis.
Click to expand...

Redline stealer is a powerful info-stealing malware that can siphon passwords stored in web browsers, credit card data, bookmarks, cookies, cryptocurrency files and wallets, VPN credentials, computer details, and more.

In some cases, Zscaler noticed that the threat actors dropped copies of the ‘RecordBreaker’ stealer malware, packed with the Themida tool for obfuscation and detection avoidance.
The information targeted by that RecordBreaker is similarly extensive, so the final payload doesn’t make much difference for the victims.
Click to expand...

Zscaler: Making victims pay, infostealer malwares mimick pirated-software download sites

Threat actors distributing infostealers are gaining momentum by targeting victims seeking to illegally download pirated software. Because obtaining and using pirated software is against the law, many individuals partaking in this type of behavior suspend proper scrutiny for the source of their download. As a result, whether they are good or bad people, victims across the world are paying the price with their private information for a single bad decision.

Discover the techniques being used to distribute these threats and unravel the infection chain from two different examples to understand how these malware developers operate and use the latest techniques to avoid detection.
Click to expand...

guest · Dec 30, 2022

New info-stealer malware infects software pirates via fake cracks sites
By Bill Toulas @billtoulas - December 24, 2022

A new information-stealing malware named ‘RisePro’ is being distributed through fake cracks sites operated by the PrivateLoader pay-per-install (PPI) malware distribution service.
Click to expand...

RisePro is designed to help attackers steal victims’ credit cards, passwords, and crypto wallets from infected devices.

The malware was spotted by analysts at Flashpoint and Sekoia this week, with both cybersecurity firms confirming that RisePro is a previously undocumented information stealer now being distributed via fake software cracks and key generators.
Click to expand...

Flashpoint reports that threat actors have already begun to sell thousands of RisePro logs (packages of data stolen from infected devices) on Russian dark web markets.
Additionally, Sekoia discovered extensive code similarities between PrivateLoader and RisePro, indicating that the malware distribution platform is likely now spreading its own information-stealer, either for itself or as a service.

Currently, RisePro is available for purchase via Telegram, where users can also interact with the developer and the infected hosts (Telegram bot).
Click to expand...

Flashpoint: “RisePro” Stealer and Pay-Per-Install Malware “PrivateLoader”

December 19, 2022
RisePro’s presence on Russian Market, and the appearance of the stealer as a payload for a pay-per-install service, may indicate its growing popularity—and viability—within the threat actor community.
Key takeaways

• “RisePro” is a stealer malware that began appearing as a stealer source for log credentials on the illicit log shop Russian Market on December 13, 2022.
• RisePro’s presence on Russian Market may indicate its growing popularity within the threat actor community.
• Samples that Flashpoint analysts identified indicate that RisePro may have been dropped or downloaded by the pay-per-install malware downloader service “PrivateLoader” in the past year.
• The appearance of the stealer as a payload for a pay-per-install service may indicate a threat actor’s confidence in the stealer’s abilities.
• RisePro appears to be a clone of the stealer malware “Vidar.”
Click to expand...

Sekoia: New RisePro Stealer distributed by the prominent PrivateLoader

December 22, 2022
PrivateLoader is an active malware in the loader market, used by multiple threat actors to deliver various payloads, mainly information stealer. Since our previous investigation, we keep tracking the malware to map its ecosystem and delivered payloads. Starting from this tria.ge submission, we recognized a now familiar first payload, namely PrivateLoader. However, the dropped stealer was not part of our stealer growing collection, notably including RedLine or Raccoon. Eventually SEKOIA.IO realised it was a new undocumented stealer, known as RisePro. This article aims at presenting SEKOIA.IO RisePro information stealer analysis.
Click to expand...

guest · Jan 16, 2023

Raccoon and Vidar Stealers Spreading via Massive Network of Fake Cracked Software
By Ravie Lakshmanan - January 16, 2023

A "large and resilient infrastructure" comprising over 250 domains is being used to distribute information-stealing malware such as Raccoon and Vidar since early 2020.
Click to expand...

The infection chain "uses about a hundred of fake cracked software catalogue websites that redirect to several links before downloading the payload hosted on file share platforms, such as GitHub," cybersecurity firm SEKOIA said in an analysis published earlier this month.

The French cybersecurity company assessed the domains to be operated by a threat actor running a traffic direction system (TDS), which allows other cybercriminals to rent the service to distribute their malware.
Click to expand...

The poisoned result comes with a download link to the promised software that, upon clicking, triggers a five-stage URL redirection sequence to take the user to a web page displaying a shortened link, which points to a password-protected RAR archive file hosted on GitHub, along with its password.

"Using several redirections complicates automated analysis by security solutions," the researchers said. "Carving the infrastructure as such is almost certainly designed to ensure resilience, making it easier and quicker to update or change a step."
Should the victim uncompress the RAR archive and run the purported setup executable contained within it, either of the two malware families, Raccoon or Vidar, are installed on the system.
Click to expand...

The development comes as Cyble detailed a rogue Google Ads campaign that employs widely-used software such as AnyDesk, Bluestacks, Notepad++, and Zoom as lures to deliver a feature-rich stealer known as Rhadamanthys Stealer.

Users are advised to refrain from downloading pirated software and enforce multi-factor authentication wherever possible to harden accounts.
Click to expand...

Sekoia: Unveiling of a large resilient infrastructure distributing information stealers

January 6 2023
This blogpost aims at presenting the current infection chain, payloads and the whole infrastructure used to distribute infostealers
A common scheme to trick the victim is a tutorial that demonstrates how to install a cracked software, which turns out to be an information stealer. For the distribution method, the victim enters a malicious website either promoted through a Google Ad, or SEO poisoned (Search Engine Optimization), or shared in a legitimate community space. To assist the victim in compromising its system, the tutorial often describes step-by-step how to disable the antivirus software, download the fake installer and run it.

SEKOIA.IO analysts unveiled a large and resilient infrastructure used to distribute Raccoon and Vidar stealers, likely since early 2020. The associated infection chain, leveraging this infrastructure of over 250 domains, uses about a hundred of fake cracked software catalogue websites that redirect to several links before downloading the payload hosted on file share platforms, such as GitHub.
Click to expand...

Log in or Sign up

Pirated Software is All Fun and Games Until Your Computer becomes infected with Malware

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Pirated Software is All Fun and Games Until Your Computer becomes infected with Malware

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches