A Catalog of Hazardous AV Sites – A Tale of Malware Hosting

MITRE Techniques

• [T1189] Drive-by Compromise – The site is hosting Avast.apk when we try to click any of the links there. Quote: “The site is hosting “Avast.apk” when we try to click any of the links there.”
• [T1036.005] Masquerading – Files appear as legitimate software (Avast.apk, MBSetup.rar, setup-win-x86-x64.exe.zip) to mislead users. Quote: “Seeing the filename with double extension before extension and since the legitimate software never downloads the file with double extensions, we became curious to investigate this file more.”
• [T1027] Obfuscated/Compressed Files and Information – TLS callback and obfuscated strings decoded before main execution. Quote: “The file has a TLS callback where it can perform its activity before going to the Entry Point of the file. This is where all the obfuscated strings were decoded as shown below.”
• [T1055] Process Injection – Payload injected into BitLockerToGo.exe via thread-suspend-resume. Quote: “injecting into BitLockerToGo.exe… by creating thread-suspend-resume.”
• [T1056] Input Capture – Touch/interaction data collected (screen touches and coordinates). Quote: “Identifying position of screen touches.”
• [T1113] Screen Capture – Taking a screenshot as part of data collection. Quote: “Taking a screenshot.”
• [T1123] Audio Capture – Audio recorder and touch activity logger used to monitor user actions. Quote: “Audio recorder & touch activity logger.”
• [T1555.003] Credentials from Web Browsers – Stealer targets browser data and credentials (User Data, Local DB, autofill, cookies). Quote: “Credentials from the browser ‘User Data’ folder, Local DB and autofill” and “Cookies from the browser.”
• [T1041] Exfiltration Over C2 Channel – Exfiltrated data compressed with gzip and sent to C2C. Quote: “All the exfiltrated contents have been compressed in gzip to send it to the C2C server.”
• [T1071.001] Web Protocols – C2C infrastructure used to communicate with attacker-controlled servers. Quote: “C2C servers” and references to C2C endpoints.