This morning we detected two new sites promoting a new version of the Antivirus XP 2008 rogue. We have captured a video of our encounter for your viewing. The file has been added to the Malware Database under /Malware/lithium-malware.
Sites hosting the rogue software: *proceed at your own risk*
hxxp://antivirusxp-08.com
hxxp://antivirusxp-2008.com
JoeBox Sandbox Report: here
Removal:
Remove this threat with MalwareBytes!
VirusTotal:
File AntivirusXP2008Installer.exe received on 07.26.2008 19:56:35 (CET)
Result: 7/35 (20.00%)
| File size: 1399061 bytes |
| MD5…: e979fb2eb504972ed87ad3c825ec6c2c |
| SHA1..: 7a927cfa6d413f66da1ae05f668ce85b3547aaf2 |
| SHA256: 9d45ae1d8d3749efbe72b24bc20142e8c55b88a0733a45e5fe8579cf24981f33 |
| SHA512: df1b55bff5fdee03cd77d59befe5ccfef555100605f7e9782e0a90e21ad6f67c 92bdf925e2844d042c9da48e1c05eb4970460683aebbec2bf5a3f9cf6341bee6 |
| PEiD..: - |
| PEInfo: PE Structure information
( base data ) ( 5 sections ) |
Oh my god. That is the most realistic fake anti-virus software I have ever seen.
Are there any risks with using a VM machine to test for malware?
It is pretty realistic looking! Hopefully not too many people fall for it… That’s exactly why we created this video. Even though the Antivirus XP 2008 trademark has been known to be rogue for quite some time, hopefully we can raise some more awareness about it. Regarding your question about malware testing on a VM. There have been some recent directory traversal exploits if you use shared folders but other than that it is *relatively* safe.
Cool stuff. It’s interesting that users have been trained (by legitimate AV) to react to intrusive security software by just clicking through to website and giving credit card number to make the bad news go away.
Has anyone traced the source of these fake AVs? Built with kits for sale or part of some big network of scam artists?
Re: Vmware - *fairly* safe. But a good portion of malware is “vmware-aware” and you may get different behaviors in virtual vs. real machines.
I have not looked into the origin yet but the payment gateway is the same old server in Ukraine. Re: VMWare –> Yes, you are correct. Most malware have simple vmware detection mechanisms but they are not too hard to get around. (I.e. Most just detect presence of vmware tools)
Yeah, I fell for it HARD. Details on my blog with screen shots. PCillin didn’t even flinch. I think I cleaned it up with SuperAntiSpyware.
The site it came from was a knitting site!
GoingLikeSixty: Back in the day you got infected if you were visiting obviously bad websites. These days you get infected after searching for common things like “free baby blanket knitting pattern”. Sad, just sad.