Sneaking Through Windows: Infostealer Malware Masquerades as Windows Application

guest · Oct 29, 2021

Google Chrome is Abused to Deliver Malware as ‘Legit’ Win 10 App
October 29, 2021
https://threatpost.com/chrome-deliver-malware-as-legit-win-10-app/175884/

Crooks behind a newly identified malware campaign are targeting Windows 10 with malware that can infect systems via a technique that cleverly bypasses Windows cybersecurity protections called User Account Control (UAC).

Researchers from Rapid7 recently identified the campaign and warn the goal of the attackers is to extricate sensitive data and steal cryptocurrency from the targeted infected PC.
Click to expand...

Andrew Iwamaye, Rapid7 research analyst, said that the malware maintains persistence on PC “by abusing a Windows environment variable and a native scheduled task to ensure it persistently executes with elevated privileges.”

Iwamaye wrote in a blog post published Thursday, the attack chain is initiated when a Chrome browser user visits a malicious website and a “browser ad service” prompts the user to take an action. Inquiries as to what the researcher is identifying as a “browser ad service” have not been returned as of this writing.
Click to expand...

Rapid7: Sneaking Through Windows: Infostealer Malware Masquerades as Windows Application

The malware is classified as a stealer, which intends to steal sensitive data from an infected asset (such as browser credentials and cryptocurrency), prevent browser updates, and allow for arbitrary command execution.

The malware we summarized in this blog post has several tricks up its sleeve. Its delivery mechanism via an ad service as a Windows application (which does not leave typical web-based download forensic artifacts behind), Windows application installation path, and UAC bypass technique by manipulation of an environment variable and native scheduled task can go undetected by various security solutions or even by a seasoned SOC analyst.
Click to expand...

Log in or Sign up

Sneaking Through Windows: Infostealer Malware Masquerades as Windows Application

guest Guest

Log in or Sign up

Sneaking Through Windows: Infostealer Malware Masquerades as Windows Application

guest Guest

Useful Searches