If Qhioo360 Safe Guard or Internet Security are found on the system, the malware runs once, without persistence. This functionality, however, is no longer automatically used, the researchers discovered. The backdoor also embeds Adblock Plus for IE, also modified similarly to the Chrome extension and capable of injecting remote JavaScript. Every minute, the malware checks if Chrome is running, and can silently launch it if it doesn’t. The extension constantly runs in the background, as a stealth host based crypto-miner.

The malicious Chrome extension dropped by the malware is a patched version of Adblock Plus, which injects an in-browser crypto-mining module (based on CryptoNoter ) and an in-browser payment hijacking module. These include a virtual machine detection code taken directly from HackingTeam’s “Soldier” implant (which targets Cuckoo Sandbox, VMware products, and Oracle’s VirtualBox) and the DynamicCall module from HackingTeam’s “core” library (dynamically calls external library function by obfuscating the function name, thus making static analysis more difficult). Specifically, the cybercriminals used two main functions in their IronStealer and Iron ransomware families. Part of the backdoor’s code is based on HackingTeam ’s leaked RCS source code, the researchers say. It also installs a malicious certificate to sign the backdoor binary as root CA, then creates a service pointing back to the backdoor. The malware also checks if Qhioo360 products are present on the systems and only proceeds if none is found.

Their new backdoor, the security researchers say, was first observed in April this year and features an installer protected with VMProtect and compressed using UPX.ĭuring installation, it checks if it runs in a virtual machine, drops and installs a malicious Chrome extension, creates a scheduled task, creates a mutex to ensure only one instance of itself is running, drops the backdoor in the Temp folder, then checks OS version and launches the backdoor based on the platform iteration. To date, the group is believed to have infected at least a few thousand victims. The Iron group is known for the Iron ransomware (which a rip-off Maktub malware) and is believed to have been active for around 18 months.ĭuring this time, the cybercriminals built various malware families, including backdoors, crypto-miners, and ransomware, and targeted Windows, Linux, and Android devices. A recently discovered backdoor built by the Iron cybercrime group is based on the leaked source code of Remote Control System (RCS), HackingTeam ’s infamous surveillance tool, security firm Intezer reports.

Upx file is modifiedhackedprotected