Puzzling New Malware Blocks Access to Piracy Sites

Scientists have admitted they are baffled by a new piece of malware mainly created to reduce victims from checking out software piracy internet sites.

Sophos principal researcher, Andrew Brandt, branded the discovery “one of the strangest cases I have noticed in a whilst.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

It is hidden in pirated copies of various program, like security products, and distributed on match chat assistance Discord and as a result of Bittorent. After double-clicked, it works by flashing up a bogus mistake concept on the victim’s screen while executing.

The malware evidently blocks contaminated users from traveling to a significant range of piracy web pages by modifying the HOSTS file on their methods. Brandt explained this as a “crude but effective” technique — crude since despite the fact that it functions, the malware has no persistence system.

This means that everyone can clear away the HOSTS file entries and continue to be eliminated unless the method is run a next time. Bizarrely, Brandt claimed to have uncovered a malware family that behaved almost identically additional than a decade back.

The malware also downloads and executes a second payload, an executable named “ProcessHacker.jpg.”

It’s detected by Sophos as Mal/EncPk-APV.

Brandt mentioned that the malware developer’s end activity is still a mystery.

“On the deal with of it, the adversary’s targets and equipment advise this could be some kind of crudely compiled anti-piracy vigilante procedure. Nevertheless, the attacker’s large potential concentrate on viewers — from players to company professionals — blended with the curious combine of dated and new resources, procedures and processes (TTPs) and the weird list of internet sites blocked by the malware, all make the ultimate goal of this operation a little bit murky,” he added.

“There could not even be an in general function to this attack at all. On the other hand, that does not decrease the level of risk or the possible disruption for victims.”

Brandt urged consumers to put in a strong security solution to location these types of threats and keep away from downloading pirated or “too excellent to be true” software package.