It’s crude because, while it works, the malware has no persistence mechanism. Modifying the HOSTS file is a crude but effective method to prevent a computer from being able to reach a web address.
The malware also downloaded and delivered a second malware payload, an executable named ProcessHacker.jpg In one of the strangest cases I’ve seen in a while, one of my Labs colleagues recently told me about a malware campaign whose primary purpose appears to stray from the more common malware motives: Instead of seeking to steal passwords or to extort a computer’s owner for ransom, this malware blocks infected users’ computers from being able to visit a large number of websites dedicated to software piracy by modifying the HOSTS file on the infected system.
0 kommentar(er)
