Fruity trojan downloader performs multi-stage infection of Windows computers
news.drweb.com
Doctor Web has uncovered an attack on Windows users involving a modular downloader trojan dubbed Trojan.Fruity.1. With its help, threat actors can infect computers with different types of malware, depending on the attackers’ goals. To conceal an attack and increase the chances of it being successful, they use a variety of tricks. These include a multi-stage infection process for target systems, using harmless apps for launching components of the trojan, and trying to bypass anti-virus protection.

Summary

What is Trojan.Fruity.1?

  • A modular downloader trojan that can be used to distribute other malware.
  • Distributed through malicious websites and software installers that appear to be legitimate.
  • Once installed, Trojan.Fruity.1 begins a multi-stage infection process that can ultimately lead to the installation of the Remcos RAT spyware.

How does it work?

  • The trojan is implanted into legitimate programs, such as Python libraries, VLC mediaplayer, and VMWare virtualization software.
  • The trojan uses a variety of techniques to evade detection, including encryption, steganography, and process hollowing.
  • The trojan can be used to infect computers with other malware, such as ransomware, cryptominers, and backdoors.

How to prevent infection?

  • Only download software from trusted sources.
  • NightOwl@lemmy.oneEnglish
    26·
    11 months ago

    When a visitor tries to download an app from a fake site, they are redirected to the MEGA file hosting service webpage, which offers them a zip file, containing a trojan installer package, for download.

    Another reason to use adblockers. Does ads that are part of search engine results can be dangerous.

    • Zeron@lemmy.worldEnglish
      16·
      11 months ago

      Yep. There’s a reason whenever i install an adblocker for a friend or family member they suddenly and mysteriously no longer “get viruses” anymore.

      Ad blocking is a security measure, because these ad networks have zero accountability for what you are shown. I will never in a million years allow ads onto my network intentionally. If i deem a service good enough that i think they deserve my money, i grab some merch or throw them a donation. It gives them more than tens of thousands of my ad impressions ever would.

    • Raisin8659@monyet.ccOPEnglish
      10·
      11 months ago

      Yes, for home, if you are not installing ad-blockers for all your family members, you can set AdGuard DNS, etc., as DNS servers on your router to somewhat mitigate the ad/malware/scam problem for the entire location.