#My kaspersky login drivers
#My kaspersky login archive
#My kaspersky login software

In this case, we observed two detection evasion tricks during the runtime: Further commands are related to decoding and decrypting that binary, then running it in memory, within a newly created aspnet_compiler.exe process, a legitimate Windows. The payload is a base64-encoded, AES-encrypted fileless binary. In a nutshell, the loader runs a new powershell.exe process and manipulates it to execute numerous PowerShell commands, which instruct it to access a third-party URL in order to get the payload. It seems to use an anti-debugging technique in order to prevent a debugger from executing and dynamically analyzing the binary. NET file protected by an unregistered version of. This short-lived process is the loader for the malware.

The screenshot above shows the actual software installer running, but if we take a closer look at the processes, we will notice a short-lived sub-process (cmd.exe /c -> “SetupFileProgram”) run by the “pre-installer”. Thus, the threat actors disguise their malicious payload through the installation of another software product by creating a “pre-installer” for the legitimate software, which will put both the malware and the desired genuine software on the victim’s machine.īlender 3D installer launched by the “pre-installer” Additionally, the initial installer also runs the original Blender 3D MSI to make the victim believe that the desired software is running.

The deflated malicious loader size is about 330 KB, and the rest is junk.Īfter the initial installer (extracted from the archive) drops these two files, it runs the malicious PE file using the CMD method (cmd.exe /c command) to hide it from the user. The size of the dropped malicious loader is this big because it is inflated with junk bytes when the PE file is created. A PE file that acts as a next-stage loader for a malicious PE file (marked red), which also has the same size as the original installer: 657 MB.ĭropped files: the original Blender 3D MSI installer and the malicious loader.The original Blender 3D MSI installer (marked green on the screenshot below), whose size is also 657 MB.When launched, it drops two files into the temp directory:

The size of the file (BBA8AA93FCDDA5AC7663E90C0EEFA2E7) extracted from the archive is 657 MB.

When the user clicks the “Download” button, the archive blender-3.4.1-windows-圆4.zip (E0BDF36E4A7CF1B332DC42FD8914BA8B) is downloaded. The size of 257 MB stated on the fake web page matches that of the original Blender 3D installer, but it does not match the size of the fake download. The size of the downloaded file (ZIP archive) is 269 MB, which is close to the original Blender installer size. In this article, we will focus mainly on the “Blender 3D” fake websites. We visited some of the promoted sites and obtained the malicious payloads they were distributing. These domains lure victims to click on the link and access the fake website more often than random domains registered in a more common domain zone, such as COM, because they may look more like a legitimate website.įake AMD and Blender 3D websites in search results The use of less common TLDs enables the threat actors to register second-level domains that are similar to the real ones. In most cases, the top-level domains are different from those of the official sites as well. If we take a closer look at the URLs, we will see that the domain names incorporate the software name but are in fact unrelated to the real AMD or Blender 3D vendors.

In the following snapshots, we can see Google ads promoting fake pages for AMD drivers and the Blender 3D software. Threat actors then pay to promote the website in the search engine in order to push it to the top search results. The design and the content of the fake web pages look the same as those of the original ones. The treat actors create copies of legit software websites while employing typosquatting (exploiting incorrectly spelled popular brands and company names as URLs) or combosquatting (using popular brands and company names combined with arbitrary words as URLs) to make the sites look like the real thing to the end user-the domain names allude to the original software or vendor. They seem to use the same technique of mimicking a website associated with well-known software like Notepad++ and Blender 3D. At least two different stealers, Rhadamanthys and RedLine, were abusing the search engine promotion plan in order to deliver malicious payloads to victims’ machines. In recent months, we observed an increase in the number of malicious campaigns that use Google Advertising as a means of distributing and delivering malware.

#My kaspersky login software

#My kaspersky login archive

#My kaspersky login drivers