StrongPity variant hides behind Notepad++ installation

https://blog.minerva-labs.com/a-new-strongpity-variant-hides-behind-notepad-installation

by mesofile • 5 years ago

45 27 5 years ago

I don't see how this is relevant. Why anybody would download it from a non-official website? Maybe this post is just a Minerva advertisement.

sirl1on• 5 years ago

I'd say most non-technical windows users are used to download executables via google search.

As an example case, when you search for "vlc player", the top 3 Google results are:

- vlc.de (A scammer site blocked by my ad blocker)

- videolan.org (The authorative source and official site)

- chip.de (A german tech tabloid providing their own downloads of popular programs serving their own ads)

pantulis• 5 years ago

I find it very interesting that there is a business around creating download sites for free/opensource apps. SEO optimization there has to be cut-throat.

dehrmann• 5 years ago

"Do no evil," they say. At least they stopped running ads against "heart attack symptoms."

benbristow• 5 years ago

Installed the vlc.de thing on a VM. Seemed to just be a re-branded VLC. Even has a support forum?

https://www.vlc-forum.de/

Seems shady though.

Had a look at chip.de, that's even worse (used to be an alright site). The installer tries to offer installs of Opera, Avast and Avira - ridiculous as you shouldn't have multiple AV's installed. Albeit if you just click through nothing does actually get installed but the product you want. And then Avast tries to install Google Chrome also.

mnadkvlb2• 5 years ago

at this moment, if anyone pays google enough they will serve the result on top no matter what they serve. So if you want to survive malware, please enable an adblocker.

fun times with google and all !! /s

Scoundreller• 5 years ago

Don’t just enable it for yourself, but all your friends and family too.

Sneakily installing an adblocker without consent is within my realm of ethics.

elondaits• 5 years ago

Some months ago when the Paramount+ streaming service launched in Latin America the top Google Result in Argentina was for a fake site that imitated the original and stole credit card numbers. The domain seemed 100% legit except that it wasn’t the real one.

prepend• 5 years ago

I think there’s active SEO to trick users.

One of my kids likes to draw and play Minecraft. They’ll read about a program, Google it and try to install. 90% of the time that the software is legit, there’s some malware/adware wrapper they click on and try to install.

hvgk2• 5 years ago

Yeah. Similarly German Goo Girls is higher ranking than Girls Go Games as my 9 year old found out by accident by typing ggg in Google search. Man that took some explaining.

hvgk2• 5 years ago

Depends which malware outfit pays for top search ranking.

Also crap like sourceforge might be the official distribution platform but looks like an adware shit show site.

beh9540• 5 years ago

I worked for a company once where IT Desktop Support had to install all software, even for teams who worked in Technology. I was tasked with starting a whole new program and needed a bunch of new tools installed, and needed to supply them with a list of all these applications we'd ever need.

Out of curiosity, after they didn't provide the right software a few times, I asked the guy how he was validating they were securely sourced, etc. His reply was "Oh I just googled it and grabbed the first one." After that, I at least sent him the links of where to download it from, but I couldn't convince any of the IT executives that this policy is pretty useless if they're just grabbing and installing.

josephcsible3• 5 years ago

Let me guess: the reason this company wouldn't let you install software or give you admin rights on your own workstations was for "security"?

ssss11• 5 years ago

It’s an interesting question - I (an ex-sysadmin) would always go to official sites.

My parents on the other hand, retired and not good with computers, would just search in google and click whatever’s at the top. Their generation are completely clueless with computers and the internet. Any time I teach them something they forget it…

_bl4c• 5 years ago

How is this interesting? It's a run of the mill trojan.

ianhawes• 5 years ago

Agreed, and it’s not particularly innovative. No fancy C2 tunneling within Tor, no fileless PowerShell in-memory execution, no sneaky back door.

ASalazarMX2• 5 years ago

The bait is that Don Ho, Notepad++'s creator, is very political, and while I use it daily, it's always in the back of my mind that he (or his detractors) could use the huge installation base to make a point.

I think his tribute update to Charlie Hebdo (2015) did more bad than good for his reputation.

https://thedavidjohnson.com/2015/01/12/notepad-tribute-to-ch...

Semaphor• 5 years ago

Yeah, but it’s not as if the official site was infected. A random .exe from a completely unrelated site seems to be the vector for the trojan, which brings it back to "very much not interesting" to me.

zoomablemind• 5 years ago

How about Windows Defender, is it able to detect this, esp. the keylogger?

Also curious, what's the feedback to this "variant" from virustotal?

StrongPity variant hides behind Notepad++ installation

Related Stories