Potentially Painful Programs Promising Pirated Products

A major source of PC compromise doesn't come from targeted APT campaigns or Exploit Kits, but user's clicking things that they simply shouldn't. A common practice for adware and spyware writers is hosting large numbers of seemingly legitimate files that users might trust from an unknown source. Users know trusted download locations for common packages like Flash Player or Skype, but when searching for pirated software or media, any link that promises results becomes a trusted source. ThreatLabZ has been monitoring a large campaign of two well known adware/spyware packages, namely OutBrowse and MultiPlug.

ThreatLabZ has observed filenames purporting to be popular software applications, PC games, movies, TV series, car repair guides, etc. being used to trick users into downloading and running spyware packages. Below is a sample list of filenames from this month:

• Colin McRae Rally 2.0 Full Version - FullRip   Download Low Spec PC Games   RataMap   Download Low End PC Games.exe
• adobe acrobat 8 standard serial number generator.exe
• dell bluetooth headset bh200 driver.exe
• Wii dance revolution.exe
• Besiege Free Download Game.exe
• Tropico Reloaded   Free Download PC Game Full Version.exe
• Minecraft 1.8 Crack Full Free Download.exe
• Dragon Ball Complete Series Episode1.exe
• Home.2015.720p._-DL.MaZiKa2daY.CoM.mkv.exe
• visual studio 2012 crack torrent.exe
• LEXUS LS 460 user guide provided through pdfretriever.com.exe

Once installed, the user is shown unsolicited advertisements and experiences a substantial increase in browser tracking activity. We noticed the cyber-criminals involved in these campaigns heavily leverage .info TLD domains as seen in the table below:

Domain	Adware Family
a.webboxwebs[.]info	MultiPlug Adware
get1.0111design[.]info	Outbrowse Adware
a.positionpublic[.]info	MultiPlug Adware
a.parser-case-croc[.]info	MultiPlug Adware
get.0136g[.]info	Outbrowse Adware
a.linuxcallring-north[.]info	MultiPlug Adware
a.northsinglemultiple[.]info	MultiPlug Adware
get.0136h[.]info	Outbrowse Adware
a.valuevilleville[.]info	MultiPlug Adware
a.cooledon[.]info	MultiPlug Adware
a.beeforcelevel[.]info	MultiPlug Adware
a.stickercenter[.]info	MultiPlug Adware
get.0136i[.]info	Outbrowse Adware

OutBrowse

The OutBrowse family authors leverage popular TV shows, software applications and trending news to deliver custom payloads that monitor the user's browsing activity. Their business model is to direct users to a pay site that provide various services.

Didn't I just download Tony Hawk Pro Skater2.Crack.CDKEY.exe?

The phone home communication for OutBrowse also provides excessive information to the advertisers. This data often includes the system's MAC address, IP address, different browser versions installed, and the machine GUID.

Data Collection from the victim's system.

OutBrowse beacons to several domains to share machine details and send aggressive advertisements. We have been monitoring this activity to the following domains for several months:

• srv.dmdataserver[.]com
• static.revenyou[.]com
• srv.desk-top-app[.]info

Consistent traffic to known Outbrowse beacons

OutBrowse is normally found on the victim's machine by inspecting the user's C:\Documents And Settings\user\Local Settings\Temp\ directory for any suspicious files. It's common for OutBrowse to also install other bundled software packages as well. Users should check their autostart programs and Browser Helper Object (BHO) entries for software that is suspicious.

OutBrowse installed MiniGet as a BHO and Content Menu in Internet Explorer

MultiPlug

MutliPlug is another adware package that is installed as part of this campaign. The purpose of this package is to provide a custom executable to the victim that leads to additional bundleware. After a successful MultiPlug infection, we noticed applications like LightningDownloader, SeekerFoobar, WeatherBug, and EasyAutoRefresh getting dropped on the victim machine.

Silent Installers seen to download additional adware packages.

Once MultiPlug is installed, it starts downloading and installing additional packages in the background while displaying unsolicited advertisements.

A common location-targeted advertisement seen from a package installed by MultiPlug

Highly aggressive advertisements attempting to lead the victim to buying software.

The best way to remediate this attack is to review all installed programs through Windows Control Panel and odds are good that MultiPlug installed at least multiple unwanted software packages. Once this is done, users should review their autostart job files in the C:\WINDOWS\Tasks\ directory for anomalous entries. Installed Browser Helper Objects should also be checked using applications like HiJackThis or X-rayPC.

ThreatLabZ has been closely monitoring these campaigns for the past few months and the trend shows no sign of slowing down as seen in the time chart below:

Several sites are phishing users with the promise of illegally obtained content

The bulk of these attacks are hosted in the United States.

Conclusion

The moral of this story is to not trust seemingly legitimate content if you are attempting to obtain it illegally. Users show a distinct lapse in judgment when they believe the desired content is available for free. We recommend not attempting to pirate content and simply paying for the media desired.

March Madness Ads, Scams, and Malware

Introduction

March Madness is officially upon us, with the last games of the round of 64 taking place today. As is usual with events that have such a level of interest, bad actors across the internet will be trying to get their cut of the action through topical spam advertising and phishing as well as search engine poisoning to draw ad revenue and in some cases, deliver malicious software. Though it is still early in the cycle of March Madness interest, we have seen a bit of everything: malware purporting to be NCAA bracket templates, a rash of ad-filled sites running March Madness related SEO campaigns, and the usual complement of shady streaming sites promising live streams of the tournament games (with some delivering a nasty surprise).

NCAA Tournament related traffic shows a sharp uptick as the games began.

NCAA Bracket Download Leads to Malware

While reviewing some of the tournament-related security blocks, we spotted an interesting file download attempt. It's not clear if the original click was derived from a search, but the primary link purports to be a zipped PDF file that can be used to create personalized brackets. The link ultimately directs to an unwanted EXE signed by the Ukranian publisher BERSHNET LLC (whose history is well documented on HerdProtect).

The downloaded file features a valid Authenticode Certificate.

The binary features an unusual number of protections against analysis for what appears to be simple adware. At this time, we have not fully explored the capabilities of the binary, but analysis shows that the sample gathers system information and sends it to a CloudFlare-hosted command & control server.

HTTP Check-in activity includes POSTing system information.

Fake .tk Blogs Generate Ad Revenue and Expose Users

Numerous ad-filled and auto-generated blogs have been popping up to take advantage of unwary search-engine users looking for bracket templates and related web-searches. While we have not seen any overtly malicious behavior on these sites, they represent a potential threat against the unwary searcher.

Auto-generated blogs taking advantage of popular search terms.

An interesting trend among these sites is the use of the free country TLD .tk. This isn't too surprising since the use of free domains is similar to the use of a dynamic DNS service, but the .tk TLD is slightly less conspicuous compared to no-ip.com or other common alternatives.

Streaming Scams Deliver Malware

Similar to sites offering bracket templates and insights on the match-ups, a large number of sites promising the ability to stream NCAA games have popped up to capture search traffic and generate ad-revenue. Unlike the SEO blogs, we have spotted -- and blocked -- malicious downloads related to tournament streams.

Numerous scam sites are found among the top Google hits.

Fake streaming site is filled with ads and fake plug-in install prompts.

Download page for fake plug-in emulates Adobe look and feel.

Although this binary does not initially appear as sophisticated as the fake-bracket sample above, it downloads two supplemental encrypted files, one large binary blob and one base-64 encoded text file. Further analysis is needed to enumerate all functionality, but the malware can be observed collecting system information and sending it to a remote server.

Post-infection activity downloads another binary and POSTs system information.

It should be noted that the NCAA has put tight restrictions on the streaming of the tournament, and apart from the first round, streaming the games requires a pay-TV subscription.

Conclusion

All of these examples should highlight the diversity of threats that latch on to the popularity of March Madness. We would like to advise the readers to exercise caution when doing searches or clicking on links related to March Madness.

Zscaler ThreatLabZ has deployed multiple layers of protection against these scams, safeguarding the users even when they are tricked into clicking a nefarious link.

Adware Utilizes Google Docs to Scam Users

Spammers are no stranger to exploiting existing file-sharing services to propagate their warez and Google has been used in the past to bring some sense of legitimacy to a scam.  In a scam that we recently uncovered, user's will receive a URL shortened link, which will lead them to a malicious ad, hosted within Google Docs. There is no malware explicitly hosted on Google docs, but rather a link to a scam which is too tempting not to click...

A must-click to be sure.

This particular scam is capitalizing on PC video gamer's desire to download free software. The download link will take the user to freeware site that will supposedly give them the most innovative Goat game to date.

gripped(.)biz redirects the user to many different Adware packages

User's will leave the site disappointed however, when they realize that the only thing available is a series of fake codecs, media players, and Browser Helper Objects.

User's come for the Goat Simulator, but stay for the bogus media player.

In this specific attack, user's are subjected to just about every modern adware scam to date.  I attempted the download a few times and uncovered separate packages which scored very low on VirusTotal.

ShopAtHome Toolbar - b181e5f9cfa97c43841fe2e385c974fa
MediaPlayerClassic - 408e8969cd0abd153eab6696f8add363

Sadly, neither download provides access to Goat Simulator 2014, but instead just continues to take advantage of the user's good faith by offering them free gift cards if they enter their e-mail address and Personal Identifiable Information.

Any e-mail address will be spammed.

The conclusion that users and administrator's should come to is that there is no safe haven from malicious or suspicious content on the Internet.  All content should come under the scrutiny of a security solution, including Google Document Sharing. Nothing in this life is free, let alone the most innovative Goat Simulator ever conceived by man.

Beware of Skype Adware

During our daily log analysis, we recently encountered a sample purporting to power up Skype with different emoticons. The binary, when installed, integrated itself with Skype and sent the following message contacts without further intervention.

The binary in question (SkypEmoticons.exe) can be downloaded from hxxp://skypemoticons.com/.

Home page of hxxp://skypemoticons.com/ 

After installation it dropped following executable files:

Most of the dropped files are Adware which may lead to some malicious activities.

Here is the VT report for SkypeEmotions.exe.

VT reports of the various dropped samples:

MD5	VT Hits
aa9af86b02f4e497eb0284872b50af41	21/54
e96f6d6257bdcb54c297569d42219e97	22/54
1d283dd3ae2312eee624e8b8c46f6adb	45/51
666ab79b63833a2a2502c119f0843b4a	22/54
364207a743ff39207667a0c89ff38768	20/53
02861acc8be1b59be2db226947a384b2	5/54
23912df27a61ea0463c5509ba6a97579	38/52
cee68ad38668785cd39e37ca069f8b85	19/54
b4eb856acc30b0005a44b87566850fb3	3/54
2830932fca42074f17c46c56b4942ac2	23/54

Contacted sites from which dropped files were downloaded:

• hxxp://homebestmy.info
• hxxp://superstoragemy.com
• hxxp://setepicnew.info
• hxxp://198.7.61.118
• hxxp://54.187.76.32
• hxxp://54.213.103.160

We also observed User-Agent: TixDll being used for downloading the files, which provided a handy mechanism to do some data mining and identify other domains associated with the adware. The following malicious domains were observed to be contacted via this User-Agent:

hxxp://getapplicationmy.info          zulu report
hxxp://applicationgrabb.com              zulu report
hxxp://appmegga.info                               zulu report
hxxp://downlloaddatamy.info           zulu report

Other domains identified in our logs contacted by this User-Agent are not currently showing any malicious activity, but may deliver some malicious content in the future:

hxxp://appussajob.info
hxxp://dirgreatbestepicl.info
hxxp://embededstub.de.drive-files-b.com
hxxp://embededstub.download.dmccint.com
hxxp://fra-7m17-stor06.uploaded.net
hxxp://getdirfrfee.info
hxxp://getgoolld.info
hxxp://getinstaal.info
hxxp://getmeegan.info
hxxp://homebestmy.info
hxxp://setepicnew.info
hxxp://softservers.net
hxxp://superstoragemy.com
hxxp://xml.dljs.org

Use caution when installing any add-on program, especially one that is able to control a powerful communication tool such as Skype.