Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

IObit Forums Hacked In Widespread DeroHE Ransomware Attack

IObit Forums Hacked In Widespread DeroHE Ransomware Attack

Windows utility developer IObit was hacked over the weekend to perform a widespread attack to distribute the strange DeroHE ransomware to its forum members.

IObit is a software developer known for Windows system optimization and anti-malware programs, such as Advanced SystemCare.

Over the weekend, IObit forum members began receiving emails claiming to be from IObit stating that they are entitled to a free 1-year license to their software as a special perk of being a forum member.

IObit ‘Promo’ email

Included in the email is a ‘GET IT NOW’ link that redirects to hxxps://forums.iobit.com/promo.html. This page no longer exists, but at the time of the attack, it was distributing a file at hxxps://forums.iobit.com/free-iobit-license-promo.zip.

This zip file [VirusTotal] contains digitally signed files from the legitimate IObit License Manager program, but with the IObitUnlocker.dll replaced with an unsigned malicious version shown below.

Also Read: Limiting Location Data Exposure: 8 Best Practices

Malicious IObitUnlocker.dll DLL
Source: BleepingComputer

When IObit License Manager.exe is executed, the malicious IObitUnlocker.dll will be executed to install the DeroHE ransomware to C:\Program Files (x86)\IObit\iobit.dll [VirusTotal]and execute it.

As most executables are signed with IOBit’s certificate, and the zip file was hosted on their site, users installed the ransomware thinking it was a legitimate promotion.

Based on reports at IObit’s forum and other forums [12], this is a widespread attack that targeted all forum members.

A closer look at the DeroHE ransomware

BleepingComputer has since analyzed the ransomware to illustrate what happens when executed on a victim’s computer.

When first started, the ransomware will add a Windows autorun named “IObit License Manager” that launches the “rundll32 “C:\Program Files (x86)\IObit\iobit.dll”,DllEntry” command when logging in to Windows.

Emsisoft analyst Elise van Dorp, who also analyzed the ransomware, stated the ransomware adds the following Windows Defender exclusions to allow the DLL to run.

@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"
@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"\Temp\\"
@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionExtension=\".dll\"
@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionProcess=\"rundll32.exe\"

The ransomware will now display a message box claiming to be from IObit License Manager stating, “Please wait. It may take a little longer than expected. Keep your computer running or screen on!’ The ransomware shows this alert to prevent victims from shutting off their devices before the ransomware finishes.

Fake alert to not turn off the computer
Source: BleepingComputer

When encrypting victims, it will append the .DeroHE extension to encrypted files.

Files encrypted by the DeroHE ransomwareFiles encrypted by the DeroHE ransomware
Source: BleepingComputer

Each encrypted file will also have a string of information appended to the end of the file, as shown below. The ransomware may use this information to decrypt files if a ransom is paid.

{"version":"3","id":"dERiqiUutvp35oSUfRSTCXL53TRakECSGQVQ2hhUjuCEjC6zSNFZsRqavVVSdyEzaViULtCRPxzRwRCKZ2j2ugCg5r9SrERKe7r5DVpU8kMDr","parts":[{"size":193536,"esize":193564,"offset":0,"rm":"Phj8vfOREkYPKA9e9qke1EIYOGGciqkQBSzfzg=="}],"ext":".png"}
Hex edit of an encrypted file
Source: BleepingComputer

On the Windows desktop, the DeroHE ransomware will create two files named FILES_ENCRYPTED.html, containing a list of all encrypted files, and the READ_TO_DECRYPT.html ransom note.

The ransom note has the title of ‘Dero Homomorphic Encryption,’ and promotes a cryptocurrency called DERO. This note tells the victim to send 200 coins, worth approximately $100, to the listed address to get a decryptor.

DeroHE ransomware ransom note
Source: BleepingComputer

Enclosed in the ransom note is the ransomware’s Tor site http://deropayysnkrl5xu7ic5fdprz5ixgdwy6ikxe2g3mh2erikudscrkpqd.onion, which can be used to make the payment.

Of particular interest, the Tor site states that IObit can send $100,000 in DERO coins to decrypt all victims, as the attackers blame IObit for the compromise.

“Tell iobit.com to send us 100000 (1 hundred thousand) DERO coin to this address. dERopYDgpD235oSUfRSTCXL53TRakECSGQVQ2hhUjuCEjC6zSNFZsRqavVVSdyEzaViULtCRPxzRwRCKZ2j2ugCg26hRtLziwu”

“After payment arrive, all encrypted computer (including yours) will be decrypted. THIS IS IOBIT’s FAULT to made your computer getting infected,” the DeroHE Tor payment site states.

Also Read: 10 Practical Benefits of Managed IT Services

Dero Ransomware Tor payment site
Source: BleepingComputer

The ransomware is being analyzed for weaknesses, and it is not known if it can be decrypted for free.

Furthermore, it is unknown if the threat actors will keep their word and provide a decryptor if payment is made.

IObit forums likely compromised

To create the fake promotion page and host a malicious download, the attackers likely hacked IObit’s forum and gained access to an administrative account.

At this time, the forums still appear to be compromised, as if you visit missing pages that return a 404 error code, the web page will display dialogs to subscribe to browser notifications. Your browser will begin to receive desktop notifications promoting adult sites, malicious software, and other unwanted content when subscribed.

Compromised IObit forum page
Source: BleepingComputer

Furthermore, if you click anywhere on the page, a new tab will open showing advertisements for adult sites. Other site sections also appear to be compromised as clicking on forum links redirect you to similar adult pages.

Attackers compromised the forum by injecting a malicious script on all pages that are not found, as shown below.

Compromised IObit forum page
Source: BleepingComputer

BleepingComputer has reached out to IObit with questions related to this attack but has not heard back.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us