Jump to content

Recommended Posts

News from Bleeping Computers:

https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/

Personal Note: Man that nasty, if eset forum is hacked, and i got this type of email, im surely gonna be tricked. Anyway, when i checked at virus total, eset still not update the dll detection yet. I wonder if in the real time it already been added to the detection?

Link to post
Share on other sites
  • Administrators

The malicious dll is already detected. VT uses an on-demand scanner which relies on engine updates. Moreover, there may be a delay of one hour after the engine update before VT reports current scan results.

iobit.dll - a variant of WinGo/Filecoder.DeroHE.A trojan

Also I can assure you that we take security seriously and have always taken measures to harden the forum against attacks.

Link to post
Share on other sites

The main thing to know about this attack was Windows Defender was bypassed since the malware created exclusions in WD to allow its malicious .dll to run undetected.

Kapersky also didn't stop files being encrypted by the ransomware portion of the attack. Per a malwaretips.com poster:

Quote

Kaspersky did not react in any way, except for the notification about attempts to go online the tor.exe files in temp directory.

Waiting until someone does a detailed analysis on this puppy.

Edited by itman
Link to post
Share on other sites
  • Most Valued Members

Elaborating on this attack, the details are as follows.

The IOBit forum website was compromised by an attacker who gained admin access to the site. This allowed him to harvest e-mail addresses of forum users and plant a malicious download from the forum web site. The attacker then sent e-mails to IOBit forum users which stated they were the winners of a free one year license to an IOBit security product. At this point note that the e-mail would appear legit since the sender's address was legit.

The following are excerpts from the bleepingcomputer.com article.

Quote

Included in the email is a 'GET IT NOW' link that redirects to hxxps://forums.iobit.com/promo.html. This page no longer exists, but at the time of the attack, it was distributing a file at hxxps://forums.iobit.com/free-iobit-license-promo.zip.

This zip file [VirusTotal] contains digitally signed files from the legitimate IObit License Manager program, but with the IObitUnlocker.dll replaced with an unsigned malicious version shown below.

When IObit License Manager.exe is executed, the malicious IObitUnlocker.dll will be executed to install the DeroHE ransomware to C:\Program Files (x86)\IObit\iobit.dll [VirusTotal]and execute it.

The ransomware iobit.dll noted above was copied to a WinLogon autorun entry (assumed we are referring to the registry runonce key) and executed the next time the user logged on to his device.

Quote

When first started, the ransomware will add a Windows autorun named "IObit License Manager" that launches the "rundll32 "C:\Program Files (x86)\IObit\iobit.dll",DllEntry" command when logging in to Windows.

This is a classic example of a targeted e-mail phishing attack enhanced by added e-mail legitimacy from a trusted e-mail sender and a download from the same trusted source web site. The only way this could have been prevented other than not accessing the e-mail link, performing the download, and executing the download, would have been to inquire on the IOBit forum web site if this promo was indeed legit. That is to have performed a "two-factor authorization." Also and important is that it is not standard practice to host a software download from a forum or like web site. This would only be done via direct request from a forum moderator for problem resolution, etc. and even then, the download is from a non-forum source.

Edited by itman
Link to post
Share on other sites

Since there have been past complaints about Eset blocking IOBit web sites and software to boot, note the following also from the bleepingcomputer.com article. Obviously, the attacker used this vulnerability to exploit the IOBit web site.

Quote

Updated 01/19/20: A security researcher known as Ronny told BleepingComputer IOBit is using vBulletin 5.6.1 for their forum software.

This version of vBulletin has a known vulnerabily that allows remote attackers to gain control over the forum.

Edited by itman
Link to post
Share on other sites
On 1/19/2021 at 9:08 AM, Marcos said:

The malicious dll is already detected. VT uses an on-demand scanner which relies on engine updates. Moreover, there may be a delay of one hour after the engine update before VT reports current scan results.

iobit.dll - a variant of WinGo/Filecoder.DeroHE.A trojan

Also I can assure you that we take security seriously and have always taken measures to harden the forum against attacks.

Hi Marcos, just for curiosity. Why this signature is WinGo and not Win32/64?

Thank you  

Link to post
Share on other sites
  • Administrators
3 hours ago, Lockbits said:

Hi Marcos, just for curiosity. Why this signature is WinGo and not Win32/64?

Because it's written in Go language.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...