Friday, October 11, 2024
HomeComputer SecurityHackers Hijacked Popular Video Editing Software Website to Drop Sophisticated Malware via...

Hackers Hijacked Popular Video Editing Software Website to Drop Sophisticated Malware via Download Links

Published on

Malware protection

Hackers hijacked the official website of the popular video editing software and replaced the download links, causing the users to download the banking malware.

VSDC is the popular video editing software and the company official website has nearly 1.3 million monthly visits.

Hackers hijacked the download links that causing visitors to download the dangerous banking malware, Win32.Bolik.2, and the Trojan.PWS.Stealer (KPOT stealer) along with the editing software.

- Advertisement - SIEM as a Service

According to Doctor Web researchers, one of the VSDC developer’s computer has been compromised, which led to the website hijack. The website found to be compromised between 2019-02-21 and 2019-03-23.

Hackers injected a malicious Javascript in the VSDC website which determines the visitor’s geolocation and replaces the download link for the visitors from the UK, USA, Canada, and Australia.

So users who download the VSDC software from the website will also receive a dangerous banking malware Win32.Bolik.2, which is the predecessor of Win32.Bolik.1. As of now, 565 users have been infected with malware.

The malware is designed to perform the following functions

  • Web injections
  • Traffic intercepts
  • Key-logging
  • Stealing banking credentials

“Additionally, on 22.03.2019 the attackers changed the Win32.Bolik.2 trojan to another malware, a variation of the Trojan.PWS.Stealer, KPOT Stealer. This trojan steals information from browsers, Microsoft accounts, several messengers and some other programs. In just one day it was downloaded by 83 users,” reads Dr.web blog post.

Last year also the companies official website has been compromised and replaced with download links that download AZORult Stealer, X-Key Keylogger and the DarkVNC backdoor.

Doctor Web notified to VSDC and the download links are restored now if you downloaded the software in the period, then you will be affected. Users are recommended to install antivirus Anti-Virus/Malware Software and check their devices for infection.

Indicators of compromise IoCs

Win32.Bolik.2
fbe8f9be579dddd2bcb109ea5107005e7d914c6d: video_converter.exe
f2f2005062f6de7844b05b1d92f2a52cbec01e6a: video_editor_x32.exe
280b3d53ce23ef27f222a979b58bbaf6a25629e9: video_editor_x64.exe
30fa0e961c4c2b43a977eca4639edf058c52a6e6: codec_pack.exe
9c520a412bd3fe627848bc56c1cc7385be35edef: codec_pack.exe
6f681bb7190c6d808e43ab929c3891759b0fe5c9: codec_pack.exe
Trojan.PWS.Stealer.26030
8d1475501dad8a4e82c415c0be1a830ce169cc22: video_converter.exe
8c4f3862d50c3bbfcebd69cabf18086a835d69ca: video_editor_x32.exe
e5b8e3f61ae25fb8cbcefb34e73fe521cc57956b: video_editor_x64.exe
4cb3e80c3e75c76190608944a90e1108293c04ec: codec_pack.exe
Network Indicators
Domains
appnodejs.xyz
sync-time.info
IPs
104.223.76.230
213.252.245.146
213.252.245.229

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated

Also Read:

Ex-CIA Employee Charged for Leaking Powerful CIA Hacking Tools to WiKiLeaks

U.S Identified the Suspect Who Behind the major CIA Hacking Tools Leak and Provide to WikiLeaks

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...

SpyCloud Embeds Identity Analytics in Cybercrime Investigations Solution to Accelerate Insider and Supply Chain Risk Analysis & Threat Actor Attribution

IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading...

Abusix and Red Sift Form New Partnership, Leveraging Automation to Mitigate Cyber Attacks

The agreement has marked over 600,000 fraudulent domains for takedown in just two months...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Hackers Exploiting Zero-day Flaw in Qualcomm Chips to Attack Android Users

Hackers exploit a zero-day vulnerability found in Qualcomm chipsets, potentially affecting millions worldwide.The flaw,...

Foxit PDF Reader Vulnerability Let Attackers Execute Arbitary Code

Researchers recently disclosed six new security vulnerabilities across various software, as one critical vulnerability...