« previous next »
Pages: 1 [2] 3 4 5   Go Down

Author Topic: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]  (Read 22868 times)

0 Members and 1 Guest are viewing this topic.

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #15 on: February 26, 2015, 04:12:54 PM »
A video for you too Watch about Hal.dll missing:
https://www.youtube.com/watch?v=evV-zSM3A2k

Edit: Can the OP please remove the host links for the Malicious Website? That file is extremely dangerous. Thanks.

PS: I have removed the majority of the code.

« Last Edit: February 26, 2015, 04:16:08 PM by Michael (alan1998) »
Logged
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33904
  • malware fighter
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #16 on: February 26, 2015, 04:19:28 PM »
Hi Michael,

Please do not try to delete hal.dll in your  system  ;) as you may corrupt it big time.

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #17 on: February 26, 2015, 04:21:53 PM »
Not my video :-). Besides, that video was made inside a Virtual Machine. I know enough not to damage my system.. Even if I did... I have 3 systems at home, 2 are trustworthy to get a clean version of Hal.dll to rebuild the machine.

Actually, I wonder if that would work!? I will try that later inside a Testing Environment lol.
Logged
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

REDACTED

  • Guest
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #18 on: February 26, 2015, 04:31:27 PM »
Quote from: Michael (alan1998) on February 26, 2015, 04:12:54 PM
A video for you too Watch about Hal.dll missing:
https://www.youtube.com/watch?v=evV-zSM3A2k

Edit: Can the OP please remove the host links for the Malicious Website? That file is extremely dangerous. Thanks.

PS: I have removed the majority of the code.

Whoops, sorry about that. Where would be the best place to report an active malicious website? I did attempt to remove the http at the front to prevent users from click on the site's link by putting them in brackets.

Many thanks for the in-depth analysis. It seems far worse than i had originally imagined.

Logged

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #19 on: February 26, 2015, 04:33:43 PM »
I will be emailing Avast! Shortly with the attached file and the source. No need to email them :-)
Logged
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33904
  • malware fighter
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #20 on: February 26, 2015, 04:37:03 PM »
Hi Oliver,

For me first and foremost all go here: virus@avast.com with a link to this thread preferably,
so the avast member coder of duty can handle or forward it.
All we do here as an avast support forum member is furthering avast detection,
that is our main aim as support to this here community.

Damian
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

REDACTED

  • Guest
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #21 on: February 26, 2015, 04:40:25 PM »
I've removed links to the site in question to prevent downloads. If anyone did want to see the site in question the reddit post I pointed to has the site's url visiable. However this will be at your on perial. The bat file seems to have a really nasty kick as Michael (alan1998) pointed out.

Thanks again avast community. We are making progress towards stopping the malware in it's tracks.
Logged

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #22 on: February 26, 2015, 04:42:23 PM »
It is people like you, Polonus, Donovan etc that help us everyday with tracking these (Excuse my french) bastards down.
Logged
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33904
  • malware fighter
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #23 on: February 26, 2015, 05:09:31 PM »
Hi Michael,

And a big thank you to you and others helping us.
Together we stand strong against ignorance and unawareness.
Helping here is also helping the community great time.
All that contributed, thanks for a very interesting thread indeed,
and that you have found your way unto this marvellous platform
that Avast has provided for us all,

Damian
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #24 on: February 26, 2015, 05:52:49 PM »
Quote from: polonus on February 26, 2015, 05:09:31 PM
Hi Michael,

And a big thank you to you and others helping us.
Together we stand strong against ignorance and unawareness.
Helping here is also helping the community great time.
All that contributed, thanks for a very interesting thread indeed,
and that you have found your way unto this marvellous platform
that Avast has provided for us all,

Damian

You're quite welcome :-)
Logged
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37533
  • Not a avast user
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #25 on: February 26, 2015, 06:32:15 PM »
« Last Edit: February 27, 2015, 02:17:45 PM by Pondus »
Logged

REDACTED

  • Guest
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #26 on: February 26, 2015, 07:23:26 PM »
Logged

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37533
  • Not a avast user
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #27 on: February 26, 2015, 07:37:32 PM »
Norman/BlueCoat  added URL block and added detection for files as  Agent.BNNBZ  / Agent.BNNCA
« Last Edit: February 27, 2015, 02:18:02 PM by Pondus »
Logged

REDACTED

  • Guest
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #28 on: February 26, 2015, 08:07:50 PM »
Just heard back from a large enterprise firewall firm they have said that they have confirmed that the latest A/V signatures block

system32_virus_remover_v1.2.bat MD5:9cf75d716f6b698b5433db6bad4a2877 - as BAT/Ral.A!tr (trojen)

The site has also been blocked from IP Reputation database. Really happy with how things are going. Amazon also had an EC2 Abuse report sent out so hopefully they can get the instance booted offline asap.


In addition it seems the fake blog page image has been stolen from an actual twitch employee (djWHEAT), However the hacker is calling themselves ("StepTech"), As mentioned before StepTech is not related to twitch.tv and or staff.

Just amusing to see how someone has put so much effort into creating a fake identity that people would believe in.



« Last Edit: February 26, 2015, 08:40:28 PM by OliPicard »
Logged

REDACTED

  • Guest
Re: Fake Twitch Blog with System32 Malware. [Only 1 vendor currently blocks site]
« Reply #29 on: February 27, 2015, 02:56:44 PM »
The site hosting the malware has been taken offline, The domain is now pointing to GoDaddy's parked domains service.
Pondus has reported that he has been able to get Norman/BlueCoat to block the file in question.

I am awaiting confirmation from Amazon to ensure the end user cannot spin up a new EC2 instance on the account.

Thanks everyone!
Oliver
Logged
Pages: 1 [2] 3 4 5   Go Up
« previous next »