sabiz

AhnLab recently discovered instances where attackers have been distributing malware disguised as adult game executable files on file-sharing sites, and on the 10th, urged users to remain cautious.

The attackers first uploaded compressed files disguised as adult game programs to specific file-sharing sites. The accompanying post provided instructions to extract the files and run the 'Game.exe' file, along with an image of the game screen.

When users extracted the file and ran 'Game.exe' to play the game, a downloader malware was executed, which also downloaded additional malicious code from the attacker's server. As the adult game itself ran normally, users often failed to notice the malware infection.

The downloader malware then installed a remote access tool called ‘Remcos RAT’ onto the user's PC. Once infected with ‘Remcos RAT’, the attacker gains remote control of the system, allowing them to perform various malicious activities, such as keylogging, taking screenshots, controlling webcams and microphones, and downloading additional malware.

Keylogging is a form of attack where the user's keystrokes are monitored to secretly capture sensitive personal information, such as IDs, passwords, account numbers, and card details.

AhnLab V3 currently detects and blocks the malware.

To prevent infection, users are advised to follow basic security measures, including:

• Avoiding illegal content downloads and using official content websites
• Keeping operating systems, browsers, applications, and office software up-to-date with security patches
• Using the latest version of antivirus software with real-time monitoring

AhnLab’s researcher, Lee Ik-gyu, stated, "Malware distribution targeting users of illegal content through file-sharing sites is still a common issue. To prevent damage, users must only use content from official sources such as official websites."