Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.
Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- HZ Rat backdoor for macOS attacks users of China’s DingTalk and WeChat
August 27, 2024
In June 2024, Kaspersky discovered a macOS version of the HZ Rat backdoor targeting users of the enterprise messenger DingTalk and the social network and messaging platform WeChat. The samples Kaspersky found almost exactly replicate the functionality of the Windows version of the backdoor and differ only in the payload, which is received in the form ...
- Ransomware attacks on schools threaten student data nationwide
August 26, 2024
Imagine a criminal gaining unrestricted access to your child’s most private information — medical records, Social Security numbers and even details about their daily bus ride to school. This alarming scenario is becoming a reality for a growing number of families as sophisticated cybercriminals increasingly target schools across the United States, holding their computer systems ...
- Laybuy collapsed after unreported cyber attack
August 26, 2024
A Klarna rival collapsed into bankruptcy after millions of pounds was stolen in a cyber attack. The collapse of Laybuy, a buy now, pay later (BNPL) start-up, followed a previously unreported hacking between December and February that left the business on the brink. Laybuy, which had more than 750,000 customers and was headquartered in New Zealand, filed ...
- Port of Seattle says it was hit with possible cyberattack; outage affects airport, phone systems
August 25, 2024
The Port of Seattle said Saturday it was hit with a “possible cyberattack” that impacted Seattle-Tacoma International Airport, phone systems, and websites. The outage was first reported Saturday morning just after 9 a.m. PT, described as an “internet and web systems outage.” A few hours later, Seattle-Tacoma International Airport posted on X and said the Port ...
- Halliburton probes impact of cyber attack with law enforcement
August 24, 2024
Top U.S. oilfield services firm Halliburton said on Friday it was working with law enforcement to determine the extent of a computer systems breach and was yet to determine if the incident would have a material impact on its business. The $23-billion company became aware of the cyber attack on Wednesday, it said in its first ...
- Russia blames mass tech outages on DDoS attack
August 23, 2024
The Russian government has blamed the widespread outage of several popular mobile applications on a distributed denial of service (DDoS) attack. The outage affected a number of messaging apps and online services, including Telegram, WhatsApp, Skype, Wikipedia, Steam, Discord, Twitch, and VKontakte – a Russian social network. However, people in Moscow reported regaining access to services ...