Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.
Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Co-op cyber attack could be any number of things: Cyber security expert
July 12, 2024
Some stores are still dealing with problems on their shelves after a cyber attack against Federated Co-operatives Ltd. two weeks ago, but the company hasn’t said much about what’s going on. Co-op has kept customers updated as bits and pieces like cardlocks come back online, and this week when rumours began circulating about customers’ data being ...
- When spear phishing met mass phishing
July 11, 2024
Bulk phishing email campaigns tend to target large audiences. They use catch-all wordings and simplistic formatting, and typos are not uncommon. Targeted attacks take greater effort, with attackers sending personalized messages that include personal details and might look more like something you’d get from your employer or a customer. Adopting that approach on a larger scale ...
- Lessons From Restaurant Data Breaches
July 11, 2024
When was the last time you paid for something in cash? According to the Federal Reserve, only about one in five transactions are paid for by cash. With the advent of mobile payment apps, cash is no longer king. Some Americans even go so far as to say they believe hard currency will be obsolete at ...
- DodgeBox Loader Loading MoonWalk Backdoor
July 11, 2024
Threat researchers recently discovered a new loader dubbed DodgeBox. This loader shares significant traits with StealthVector, which is associated with the Chinese APT group APT41 / Earth Baku. DodgeBox functions as a loader for a new backdoor named MoonWalk, which utilizes evasion techniques such as call stack spoofing, DLL sideloading, DLL hollowing and environmental guardrails similar ...
- Gay furry hackers strike massive cyber attack against US far-right Project 2025
July 10, 2024
A collective of self-described “Gay furry hackers” called SiegedSec managed to hack into the right-wing Heritage Foundation affiliated with Project 2025 in a massive cyber attack. The hackers released two gigabytes of data, including Heritage Foundation member names, email addresses, passwords, and usernames. SiegedSec claimed responsibility for the hack on Telegram, sharing that they breached online ...
- Alleged breached data of Airport and Aviation Services Sri Lanka surfaces online
July 10, 2024
A recent post on the notorious cybercrime forum BreachForums claims that the Airport and Aviation Services Sri Lanka (AASL) has suffered a data breach. According to the post, the breached data contains approximately 7,083 records that include names, NICs, emails, passport numbers, and other sensitive data. Blurred screenshot of post alleging Airport and Aviation Services Sri ...