#Instaling Stray cracked
#Instaling Stray software
#Instaling Stray code

#Instaling Stray software

We found a few archives that were pretending to contain installers for different software packages, but that contained the same malware executable, just with a different name slapped on. The creators don’t seem to have cared that these property sheets didn’t match the filenames, and weren’t too picky about. Most of the files represented themselves as being installers for full-featured, licensed copies of games or productivity software, but many of the actual files have completely different names in the File Description field, such as “AVG remediation exe,” “BitLocker Drive Encryption,” or “Microsoft Office Multi-Msi ActiveDirectory Deployment Tool.” Properties sheet data didn’t match the filenames of the binaries (in the title bar) Likewise, the properties sheets of the malware executables doesn’t align with what the filename of the malware makes it appear to be. The certificate validity began on or around the first day most of the files appeared for download, and are set to expire on December 31, 2039. The signatures have a Signer Name that’s just an 18-character long random string of upper-case letters. This might help it pass some rudimentary checks of whether the file is signed, regardless of the cryptographic validity, but these signed files don’t bear any scrutiny.

#Instaling Stray code

Many, but not all the malware executables were digitally signed by a bogus code signer. The ones distributed through Bittorrent have been packaged in a way that more closely resembles how pirated software is typically shared using that protocol: Added to a compressed file that also contains a text file and other ancillary files, as well as an old-fashioned Internet Shortcut file pointing to ThePirateBay. The files that appear to be hosted on Discord’s file sharing tend to be lone executable files.

#Instaling Stray cracked

Files like “Left 4 Dead 2 (v2.2.0.1 Last Stand + DLCs + MULTi19)” and “Minecraft 1.5.2 Cracked ” mimic the naming conventions commonly used to label pirated software. There seem to be hundreds of different software brands represented by the filenames found in a search on Virustotal for related samples. The provenance of this file in VirusTotal was Discord Other copies, distributed through Bittorrent, were also named after popular games, productivity tools, and even security products, accompanied by additional files (more on those lower down in the story) that make it appear to have originated with a well-known file sharing account on ThePirateBay. Fake games on DiscordĪt least some of the malware, disguised as pirated copies of a wide variety of software packages, was hosted on game chat service Discord. The file adds from a few hundred to more than 1000 web domains to the HOSTS file, pointing them at the localhost address, 127.0.0.1. We weren’t able to discern a provenance for this malware, but its motivation seemed pretty clear: It prevents people from visiting software piracy websites (if only temporarily), and sends the name of the pirated software the user was hoping to use to a website, which also delivers a secondary payload. A Process Monitor log shows a fake Among Us malware executable modifying the HOSTS file It was also very familiar to me, personally, because I discovered a family of malware more than 10 years ago that performed a nearly identical set of behaviors and wrote up an analysis. Anyone can remove the entries after they’ve been added to the HOSTS file, and they stay removed (unless you run the program a second time). It’s crude because, while it works, the malware has no persistence mechanism. Modifying the HOSTS file is a crude but effective method to prevent a computer from being able to reach a web address. The malware also downloaded and delivered a second malware payload, an executable named ProcessHacker.jpg In one of the strangest cases I’ve seen in a while, one of my Labs colleagues recently told me about a malware campaign whose primary purpose appears to stray from the more common malware motives: Instead of seeking to steal passwords or to extort a computer’s owner for ransom, this malware blocks infected users’ computers from being able to visit a large number of websites dedicated to software piracy by modifying the HOSTS file on the infected system.