So you want to download some releases from snd? alright let's see at snd.webscene.ir, the distribution section menu contain a link pointing at hxtps://keygens.pro/Super, looks like there a lot of cracks over here! and the site is virus free, right?
The archive is password protected and contain only one file "setup_pass-123.exe"If we try to download some other random files from the keygens.pro collection, sometime we have variations.e.g: Any.video.converter.Ultimate.keygen-URET hxtps://keygens.pro/crack/733508/ who contain a 'readme.txt' but we still have our suspicious setup_pass-123.exe inside.antiviruses aren't really happy about the file when sent to virustotal, but hey, it's kind of normal it's a crack afterall.The file in question is identified massively as 'remcos' (avira, kaspersky, f-secure,..) remcos is a know trojan, and this time they have right.I've sent the file to my capev2 (like cuckoo sandbox but with python3) who also identified it as remcos, and even exactly version 2.7.0 Pro.
crack Keygen Showcase 2006 keygen
And what's was the 'screenshot.png' he created and then deleted? this:one of my capev2 vm, the malware have a bit oversized the screenshot tought.The file sniff keystrokes, harvest/steal private information from browsers and messenger clients, take screenshots from pc and webcam if connected, and installs itself for autorun at startup, yep that not really what we where looking for.Alright... let's search for another site then..We type "download crack" on google and we are now on keygenninja.com (former KeygenGuru) according to them.site is in second result in google main page, the authors of the sites play on search engine rankings, .. and are extremely well positioned (they pay Google for that)
Well, we have 3 files in the archive, one executable, and unless keygens.pro, this time we have the info files (nfo and diz file), apparently a release from team inferno (a cracking group who disbanded in 2006)The nfo says it was released in may 2020 and the files timestamp seem from 2020, is inferno back ?
This isn't remcos RAT like in keygens.pro, i don't know what exactly is all of this, my capev2 seem to detect it as Azorult (a know password stealer)I thinks it's a false positive for 'azorult' malware familly but this one is also harvesting credentials from browsers, bitcoin wallets clients, FTP clients, email clients...
The batch file keygen.bat unpack keygen-step-4.exe with password 83fsase3GeThis archive contain key.exe and JOzWR.dat, when key.exe is executed it will look in the same folder for the file JOzWR.dat, who is later decoded by key.exe and loaded in memory a 'lzma decoder' screenshot here in memory
In conclusion: never open or visit crack sites if you don't have the knowledge to avoid infections, use common sense as some will even try to trick you with fake nfo/fake releases.Maybe buy your softwares (or crack them yourself) to avoid that, and don't trust crack sites at all, even if they was 'legitimate' like keygens.pro, they can go rogue anytime.
Well i haven't looked a lot on keygens.pro as remcos don't really interest me at all, but funny that "if crack not found then get a trojan"i looked a bit more on cracknet.net, and when i was saying "I thinks it's a false positive for 'azorult' malware familly" yep. it appear to be Elysium Stealer/Zeromax Stealer/yahooylo.some log from the vm, that was tried to be exfiltrated to the cnc:
Meanwhile, 54.36.184.139 (crackinns.com, torrentheap.com, crackheaps.com, cracknets.net, cracksnet.net, cracknet.net, keygenit.net, keygenom.net, cracksgurus.com, keygenninja.com, serialms.com, mackeygens.com, mediagetsite.com, get.ziplink.xyz, get.ziplink.stream) are still spreading malware.Abuse sent too, but nothing followed for the moment, so here is some insight about their infra in the meantime (when all else fails, crowbar the fornicationer)Embedded mini-admin panel to administrate the fake sites, allow them to disable links, blacklist keywords on site, redirect on affil, etc..
keygens.pro is back as expected.Still distributing randomly 'setup_pass-123.exe' and some other craps like htxps://keygens.pro/crack/122490/ shity vb6 layer on that one 'Projekt1test\ApCrypterStub' appear to be communicating with dontfornicationjesus.no-ip.info, PoisonIvy RATMeanwhile, cracknet syndicat is still resilient.Although they dropped infections to 6k daily because we're making their job more difficult.Some of theirs malwares who connect to download more (not exhaustive list):
Me personally never had any issue with keygens.pro (well, at least I checked some of my old releases and they are not altered). The whole situation is quite sad, because end-users blame crackers for making/spreading viruses but the crackers have nothing to do with the malware
I tried to look at the new shenanigan of keygens.pro but that thing just wont run on my systems.SetupPass-123.exe - 468f3af5f80792d566b0601ed58e429fca80addax64 file, vs2015 runtime on import, and also "vcruntime140_1.dll" for one function (?!)the same file can be observed also in the wild at: hxxp://cuckoorental.com/backup.exesome news also about cracknet: seem they now use their domain 'crackheap' as gateway to replace cracknet.they also renewed their vidar license, as it's being used as payload in their latest malware, from the last run of today: -5a58-4241-94c5-1e119668831d/ (the 'Vbox.exe' process) 2ff7e9595c
Comments