Fruity trojan downloader performs multi-stage infection of Windows computers, masquerading as apps for fine-tuning CPUs, graphic cards, and BIOS, for hardware-monitoring, and others.
Summary
What is Trojan.Fruity.1?
- A modular downloader trojan that can be used to distribute other malware.
- Distributed through malicious websites and software installers that appear to be legitimate.
- Once installed, Trojan.Fruity.1 begins a multi-stage infection process that can ultimately lead to the installation of the Remcos RAT spyware.
How does it work?
- The trojan is implanted into legitimate programs, such as Python libraries, VLC mediaplayer, and VMWare virtualization software.
- The trojan uses a variety of techniques to evade detection, including encryption, steganography, and process hollowing.
- The trojan can be used to infect computers with other malware, such as ransomware, cryptominers, and backdoors.
How to prevent infection?
- Only download software from trusted sources.
https://news.drweb.com/show/?i=14728&lng=enOpen linkView original on monyet.cc
5 replies
Another reason to use adblockers. Does ads that are part of search engine results can be dangerous.
Yep. There's a reason whenever i install an adblocker for a friend or family member they suddenly and mysteriously no longer "get viruses" anymore.
Ad blocking is a security measure, because these ad networks have zero accountability for what you are shown. I will never in a million years allow ads onto my network intentionally. If i deem a service good enough that i think they deserve my money, i grab some merch or throw them a donation. It gives them more than tens of thousands of my ad impressions ever would.
Yes, for home, if you are not installing ad-blockers for all your family members, you can set AdGuard DNS, etc., as DNS servers on your router to somewhat mitigate the ad/malware/scam problem for the entire location.
Never mind then. Another day, another new Windows malware, nothing to see here folks.
infosec.pub has entered the chat