Although modern people’s copyright awareness is much stronger than in the past, many people always want to see if there are cracked or free versions when installing operating systems or software based on speculation and petty gains. Recently, security research units have discovered a new malware campaign that disguises itself as a Windows operating system product key cracking tool, but is actually BitRAT or a remote access Trojan.
This Windows key cracker is actually a remote Trojan
Security research organization ASEC Recently, a special LUALAR RAT was discovered, spreading through the Korean online file sharing service Webhards. The file name directly named is a Windows key authenticator that can be quickly installed. As we all know, cracked and pirated software often contain malware that can invade hardware devices. However, many people often do not take these common sense issues seriously, or do not want to spend money to buy Windows keys. Therefore, malware creators will continue to produce and spread malware through such means.
▲Posted on the Windows Key Verifier on the Korean website
When unsuspecting users download a file named “Program.zip”, they only need to enter the password “1234” to unlock and decompress it. It contains a file named “W10DigitalActivation.exe”, which looks similar to a common cracker.
▲Files included in the compressed file
“W10DigitalActivation.exe” is a 7z SFX file that contains an actual verification tool named “W10DigitalActivation.msi” and malware named “W10DigitalActivation_Temp.msi”. When the user double-clicks on the exe file, it will install both msi files onto the computer. Since the malware and the verification tool are running at the same time, the user will mistakenly think that the tool is running normally.
▲Malware in 7z SFX files
There are other features packed into this key verification tool, and it is by no means as simple a program as it seems. As shown in the figure below, one of its functions is to use the powershell command to set the Windows startup program folder (the location where the downloaded program is installed) as the exclusion path of Windows Defender, and add the BitRAT process name “Software_Reporter_Tool.exe” to the exclusion items of Windows Defender.
The malware ultimately installed was a remote access Trojan named BitRAT. Since 2020, BitRAT has been sold through hacker forums and is continuously used by attackers. Because BitRAT is a Trojan used for remote access, attackers can take control of an infected system. BitRAT not only provides basic control functions such as running process tasks, service tasks, file tasks, and remote commands, but also provides additional options such as various information stealing functions, HVNC (hidden desktop), remote desktop, mining, and proxy servers.
▲BitRAT’s C&C control interface
Therefore, I hope that everyone will be more vigilant and cautious when facing all kinds of free, cracked and other pirated software on the Internet, and not be swayed by the mentality of being greedy for small gains, so as not to cause financial and personal damage to themselves due to small losses.
Source: KOCPC Chinese