Potentially Painful Programs Promising Pirated Products

ThreatLabZ has observed filenames purporting to be popular software applications, PC games, movies, TV series, car repair guides, etc. being used to trick users into downloading and running spyware packages. Below is a sample list of filenames from this month:

• Colin McRae Rally 2.0 Full Version - FullRip   Download Low Spec PC Games   RataMap   Download Low End PC Games.exe
• adobe acrobat 8 standard serial number generator.exe
• dell bluetooth headset bh200 driver.exe
• Wii dance revolution.exe
• Besiege Free Download Game.exe
• Tropico Reloaded   Free Download PC Game Full Version.exe
• Minecraft 1.8 Crack Full Free Download.exe
• Dragon Ball Complete Series Episode1.exe
• Home.2015.720p._-DL.MaZiKa2daY.CoM.mkv.exe
• visual studio 2012 crack torrent.exe
• LEXUS LS 460 user guide provided through pdfretriever.com.exe

Once installed, the user is shown unsolicited advertisements and experiences a substantial increase in browser tracking activity. We noticed the cyber-criminals involved in these campaigns heavily leverage .info TLD domains as seen in the table below:


 
OutBrowse

The OutBrowse family authors leverage popular TV shows, software applications and trending news to deliver custom payloads that monitor the user's browsing activity. Their business model is to direct users to a pay site that provide various services.

 

Didn't I just download Tony Hawk Pro Skater2.Crack.CDKEY.exe?

The phone home communication for OutBrowse also provides excessive information to the advertisers. This data often includes the system's MAC address, IP address, different browser versions installed, and the machine GUID.

 

Data Collection from the victim's system.

OutBrowse beacons to several domains to share machine details and send aggressive advertisements. We have been monitoring this activity to the following domains for several months:

• srv.dmdataserver[.]com
• static.revenyou[.]com
• srv.desk-top-app[.]info

Consistent traffic to known Outbrowse beacons

OutBrowse is normally found on the victim's machine by inspecting the user's C:\Documents And Settings\user\Local Settings\Temp\ directory for any suspicious files. It's common for OutBrowse to also install other bundled software packages as well. Users should check their autostart programs and Browser Helper Object (BHO) entries for software that is suspicious.
 

OutBrowse installed MiniGet as a BHO and Content Menu in Internet Explorer

MultiPlug

MutliPlug is another adware package that is installed as part of this campaign. The purpose of this package is to provide a custom executable to the victim that leads to additional bundleware. After a successful MultiPlug infection, we noticed applications like LightningDownloader, SeekerFoobar, WeatherBug, and EasyAutoRefresh getting dropped on the victim machine.

 

Silent Installers seen to download additional adware packages.

Once MultiPlug is installed, it starts downloading and installing additional packages in the background while displaying unsolicited advertisements.

 

A common location-targeted advertisement seen from a package installed by MultiPlug

Highly aggressive advertisements attempting to lead the victim to buying software.

The best way to remediate this attack is to review all installed programs through Windows Control Panel and odds are good that MultiPlug installed at least multiple unwanted software packages. Once this is done, users should review their autostart job files in the C:\WINDOWS\Tasks\ directory for anomalous entries. Installed Browser Helper Objects should also be checked using applications like HiJackThis or X-rayPC.

ThreatLabZ has been closely monitoring these campaigns for the past few months and the trend shows no sign of slowing down as seen in the time chart below:

 

Several sites are phishing users with the promise of illegally obtained content

The bulk of these attacks are hosted in the United States.
 


Conclusion

The moral of this story is to not trust seemingly legitimate content if you are attempting to obtain it illegally. Users show a distinct lapse in judgment when they believe the desired content is available for free. We recommend not attempting to pirate content and simply paying for the media desired.