Nowadays, the threshold for starting your own website is not too high. With various modular website tools, there are more and more personal websites or small and medium-sized studio websites. After you have achieved some success in your hard work, when you receive a letter from a so-called investment company interested in acquiring your website, your first reaction will definitely be to be extremely happy. You will quickly open the letter and read it. You can’t wait to download the attachment to see if the acquisition amount is stated. However, at this time, you may fall into the trap of an unscrupulous person!
Unscrupulous people pretend to be investment companies and send letters of acquisition intention, but in fact they lead people to install malicious software
Foreign media focusing on network security Bleeping Computer writes about personal experiences. Generally speaking, whether it is the media, company or individual, the contact information mailbox on the website is used for cooperation inquiries, news bulletins and business contacts, so the person responsible for receiving the mail will check one by one to see if there are any important letters. Recently, Bleeping Computer received a contact signed by a “venture capital company” from the public contact mailbox provided on the website. The company hopes to invest in or acquire the Bleeping Computer website. After preliminary verification, the letter was sent by the IP of the British Virtual Server Company.
The general content of the letter states that they are a group of venture capitalists who are attracted by the website (or product) and hope to discuss with the owner about equity investment or acquisition negotiations in the project. They also request that the user can talk via phone or “Vuxner” messaging software, and provide the Vuxner account of the contact person. Due to long-term concern about network security, Bleeping Computer used virtual machines and VPNs to search for this seemingly unfamiliar and unknown communication software “Vuxner”. In one of the Google search results, I found that Vuxner has a well-designed and normal-looking official website to promote it, and claims to be a free messaging software with high privacy.
Since the letter mentioned using this software for conversation, Bleeping Computer also used a virtual machine to download, install and run it. It was later discovered that after downloading the file named “VuxnerChat.exe”, it actually installed the “Trillian” communication application on the user’s computer. After Trillian completed the installation, it further downloaded RuRAT, a legitimate remote desktop software used for malicious purposes, to the user’s computer. This type of activity looks similar to past remote access and password-stealing Trojan campaigns.
As you can see, bad actors are willing to use elaborate methods to spread malware, including fake websites, custom installers, and targeted emails. All business owners and individuals need to be wary of any unusual emails, especially conditional content that requires you to download something in order to communicate with them. Recipients should check carefully to determine whether the designated software is harmless. Simply searching and seeing a single result related to a specific program is a clear red flag and you should avoid installing and downloading this software to ensure your own safety.
Source: KOCPC Chinese