reader comments
66 with 52 posters participating
A researcher has uncovered one of the more unusual finds in the annals of malware: booby-trapped files that rat out downloaders and try to prevent unauthorized downloading in the future. The files are available on sites frequented by software pirates.
Vigilante, as SophosLabs Principal Researcher Andrew Brandt is calling the malware, gets installed when victims download and execute what they think is pirated software or games. Behind the scenes, the malware reports the file name that was executed to an attacker-controlled server, along with the IP address of the victims’ computers. As a finishing touch, Vigilante tries to modify the victims’ computers so they can no longer access thepiratebay.com and as many as 1,000 other pirate sites.
Not your typical malware
“It’s really unusual to see something like this because there’s normally just one motive behind most malware: stealing stuff,” Brandt wrote on Twitter. “Whether that’s passwords, or keystrokes, or cookies, or intellectual property, or access, or even CPU cycles to mine cryptocurrency, theft is the motive. But not in this case. These samples really only did a few things, none of which fit the typical motive for malware criminals.”
But not in this case. These samples really only did a few things, none of which fit the typical motive for malware criminals.
For one thing, they modify the HOSTS file on the PC to add entries. A lot of entries.
They had a common theme. pic.twitter.com/O1Z2fSXZ1n
— Accountability Brandt (@threatresearch) June 17, 2021
Once victims have executed the trojanized file, the file name and IP address are sent in the form of an HTTP GET request to the attacker-controlled 1flchier[.]com, which can easily be confused with the cloud-storage provider 1fichier (the former is spelled with an L as the third character in the name instead of an I). The malware in the files is largely identical except for the file names it generates in the web requests.
Vigilante goes on to update a file on the infected computer that prevents it from connecting to The Pirate Bay and other Internet destinations known to be used by people trading pirated software. Specifically, the malware updates Hosts, a file that pairs one or more domain addresses to distinct IP addresses. As the image below shows, the malware pairs thepiratebay.com to 127.0.0.1, a special-purpose IP address, often called the localhost or loopback address, that computers use to identify their real IP address to other systems.
hex editor, the executables also contain a racial epithet that’s repeated more than 1,000 times followed by a large, randomly sized block of alphabetical characters.
“Padding out the archive with purposeless files of random length may simply be done to modify the archive’s hash value,” Brandt wrote. “Padding it out with racist slurs told me all I needed to know about its creator.”
Vigilante has no persistence method, meaning it has no way to remain installed. That means people who have been infected need only to edit their Hosts file to be disinfected. SophosLabs provides indicators of compromise here.
