Weird Malware Blocks Victims from Accessing Pirated Software Sites
Security researchers with Sophos recently tracked and documented one of the most unusual malware campaigns in a very long time. This weird new malware is not trying to scrape all your login information from your browser, nor is it trying to scramble your files and ask for bitcoin ransom. All that the new malware does is block the victim's system from accessing software piracy websites.
About a decade ago, Sophos once again ran into malware that has "nearly identical" in terms of functionality. The new malware is quite humble in its own abilities, but also efficient in its simplicity.
Even though it has no persistence mechanisms, the malware modifies the Windows HOSTS file which contains a local system map that can direct domain names to specific IP addresses. The malware inserts anywhere from a hundred to a thousand domains associated with piracy websites and remaps them all to point to 127.0.0.1 - the loclahost. This effectively prevents the user from accessing those domains from a browser.
There is no additional functionality that allows the malware to re-add those HOSTS file entries and if a user figures out what is going on and edits the file manually, access will be restored until they run the malware one more time.
The distribution methods outlined in the research include Discord servers that carry alleged pirated copies of software and games. Additionally, torrent websites that are commonly used to redistribute pirated software also had the same malware payload, packaged into torrent files named after very popular downloads and media that was highly sought-after.
Once the malware deploys and modifies the HOSTS file, it also attempts an outbound connection to a domain named 1flchier dor com. If the connection succeeds, an additional payload is obtained. The payload is usually called ProcessHacker.jpg and is really an executable file that performs a number of extra steps to stop the victim system from executing and accessing pirated software.
Manual cleanup of systems that have been affected by the malware is relatively easy. Opening the HOSTS file in a plain text editor and removing all the lines that redirect various domains to 127.0.0.1 and the localhost is enough to clear things up.
There is no clear evidence of this new malware being related to an established larger family. All that Sophos managed to detect was that the piracy-blocking malware was created using the same packer used in the Qbot family of malware. The two are, however, not related in any other meaningful way.
