Malware Alert: A Scareware, Ransomware Blend

Monday, April 16, 2012 @ 01:04 PM gHale


A strain of fake anti-virus software tries to intimidate supposed file-sharers into paying for worthless software.

SFX Fake AV blends the features of scareware with those more associated with ransomware Trojans, said free antivirus scanner firm Malwarebytes. The malware stops any legitimate anti-virus package from running on compromised PCs, something common to other other scareware packages. But this particular strain of malware goes further by stopping Process Explorer (procexp.exe) and preventing browsers from loading – tactics designed to force victims to complete the “input credit card details” screen and hand over money for the scamware.

RELATED STORIES
Apple Picks Off Flashback Malware
Tool to Counter Cyber Threats
Faster Way to Cool Electronics
Botnet Rises for Third Time

The app also tells victims they are facing a lawsuit for breaching SOPA legislation, claiming it detected torrent links on PCs. It offers to get around this problem by activating an “anonymous data transfer protocol” for torrent links, another inducement aimed at persuading prospective marks into paying for the worthless security app.

This latter feature differentiates the malware from strains of scareware seen in the past, which demand money after detecting “offensive materials” on PCs, sometimes under the guise of a police fine. SFX Fake AV, by contrast, offers a way to evade law enforcement attention.

Finally, the malware also performs a fake scan that classifies Windows Registry Editor as a porn tool.

“SFX Fake AV is morphing at a relatively fast rate, so it is something that signature-based vendors will have to watch out for as there will be an increasing number of variants in the wild,” said Bruce Harrison, vice president of research at Malwarebytes. “Also, the use of Dropbox as a delivery mechanism is a something that the industry is going to have to take into account and protect against, as it is an emerging trend.”



Leave a Reply

You must be logged in to post a comment.