Swarez Trojan and Dropper Distributed under the Masqueise of 15 Δημοφιλή Παιχνίδια

In April of this year, Ειδικοί της Kaspersky Lab recorded a large-scale campaign to distribute a Trojan and a dropper named Swarez.

The malware was distributed under the guise of 15 popular games, and attempts to download such files were recorded by the company’s products in 45 countries of the world.

The dropper was introduced through various sites that imitate platforms for illegal free software distribution. Many such sites distribute malware under the guise of keys for programs, including antivirus software, photo and video editors, as well as popular games.

Site page with hacked software
An example of a site page with hacked software for distributing Swarez.

The attackers used the following games as bait: Among US, Battlefield 4, Battlefield V, Control, Counter-Strike Global Offensive, FIFA 21, Fortnite, Grand Theft Auto V, Minecraft, NBA 2K21, Need for Speed Heat, PLAYERUNKNOWN’S BATTLEGROUNDS, Rust, The Sims 4, Titanfall 2. Multiple tags were used for each post to make landing pages appear at the top of search results.

Search results

The dropper was distributed in a ZIP archive, which contained another password-protected ZIP file and a text file containing this password. The launch of the malware resulted in the decryption and activation of the Taurus stealer Trojan.

Ετσι, at the first stage of infection, the Swarez dropper executes an obfuscated CMD script that decrypts the legitimate AutoIt interpreter. Using it, the malware executes the AutoIt script, which is also obfuscated. Several checks are made to ensure that the file is not being executed in an emulated environment, and then the payload is decrypted using the RC4 algorithm. The resulting file is embedded in one of the system processes and executed in its context. This is Taurus, a paid stealer Trojan developed by the Predator ομάδα hack, with many features and customization options. It can steal cookies, saved passwords and autofill data from browsers, secrets for accessing cryptocurrency wallets, collect system information, text files from the user’s desktop, and even take screenshots. The Trojan sends all this information to the C&Διακομιστής C.

Users around the world are actively downloading software from dubious sources, and the authors of the Swarez dropper used this to their advantage. Attackers are constantly complicating their techniques and making every effort so that the user does not suspect that he is installing malware while downloading the program. That is why we recommend downloading the software only from the official websites of the developers.σχόλια Anton Ivanov, cybersecurity expert at Kaspersky Lab.

Let me remind you that I also recently wrote that Το TrickBot απέκτησε μια νέα ενότητα για την παρακολούθηση θυμάτων.

Helga Smith

Ενδιαφέρομαι πάντα για τις επιστήμες των υπολογιστών, ειδικά την ασφάλεια δεδομένων και το θέμα, που ονομάζεται σήμερα "επιστημονικά δεδομένα", από τα πρώτα μου χρόνια. Πριν μπείτε στην ομάδα κατάργησης ιών ως αρχισυντάκτης, Εργάστηκα ως ειδικός στον τομέα της ασφάλειας στον κυβερνοχώρο σε πολλές εταιρείες, συμπεριλαμβανομένου ενός από τους εργολάβους της Amazon. Μια άλλη εμπειρία: Έχω διδάξει σε πανεπιστήμια Arden και Reading.

Αφήστε μια απάντηση

Αυτό το site χρησιμοποιεί Akismet να μειώσει το spam. Μάθετε πώς γίνεται επεξεργασία των δεδομένων σας σχόλιο.

Κουμπί Επιστροφή στην κορυφή