Purple Fox malware distributed via malicious Telegram installers

guest · Jan 3, 2022

January 3, 2022

A malicious Telegram for Desktop installer distributes the Purple Fox malware to install further malicious payloads on infected devices.

The installer is a compiled AutoIt script named "Telegram Desktop.exe" that drops two files, an actual Telegram installer, and a malicious downloader.
Click to expand...

Upon execution of Purple Fox, the infected machine will be restarted for the new registry settings to take effect, most importantly, the disabled User Account Control (UAC).
Disabling bypassing UAC is vital because it gives any program that runs on the infected system, including viruses and malware, administrator privileges.
Click to expand...

At this time, it unknown how the malware is being distributed but similar malware campaigns impersonating legitimate software were distributed via YouTube videos, forum spam, and shady software sites.
Click to expand...

Minerva Labs: Malicious Telegram Installer Drops Purple Fox Rootkit

We have often observed threat actors using legitimate software for dropping malicious files. This time however is different. This threat actor was able to leave most parts of the attack under the radar by separating the attack into several small files, most of which had very low detection rates by AV engines, with the final stage leading to Purple Fox rootkit infection.

Thanks to the MalwareHunterTeam, we were able to dig deeper into the malicious Telegram Installer. This installer is a compiled AutoIt (a freeware BASIC-like scripting language designed for automating Windows GUI and general scripting) script called “Telegram Desktop.exe”: [...]
Click to expand...

Log in or Sign up

Purple Fox malware distributed via malicious Telegram installers

guest Guest

Log in or Sign up

Purple Fox malware distributed via malicious Telegram installers

guest Guest

Useful Searches