{"id":6521,"date":"2017-02-06T10:54:07","date_gmt":"2017-02-06T18:54:07","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/02\/06\/news-349\/"},"modified":"2017-02-06T10:54:07","modified_gmt":"2017-02-06T18:54:07","slug":"news-349","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/02\/06\/news-349\/","title":{"rendered":"Watch Out For Fake Online Gaming Sites And Their Malicious Executables"},"content":{"rendered":"

Credit to Author: Lilia Elena Gonzalez Medina<\/span>Lilia Elena Gonzalez Medina<\/span> | Date: Mon, 06 Feb 2017 10:15:32 -0800<\/strong><\/p>\n

\n

Every year during holiday seasons, the number of phishing websites increases. This is particularly true for online gaming distribution platforms. In some cases, users not only have their login credentials stolen, but they also end up downloading and executing malicious executables. As expected, the more popular a platform is, the more targeted it will be, which is why this research blog focuses on two malware samples obtained from fake Origin and Steam websites.<\/p>\n

\"Fake<\/p>\n

Figure 1. Fake Origin phishing website<\/p>\n

Origin Malware Sample<\/h2>\n

In addition to phishing websites that steal user credentials, we also examined a number of blogs that were being blocked by the Fortiguard Web Filtering Service. The content of these blogs seemed non-malicious at first, but after looking at the source code we discovered obfuscated JavaScript that repeatedly redirected to a URL from a Russian website until an executable was downloaded. This process was supposed to take place without the user’s intervention; however, due to a coding error the sample could not be download automatically, and the blog websites displayed this error instead:<\/p>\n

\"Malicious<\/p>\n

Figure 2. Malicious blog intended to download malware<\/p>\n

Despite this, all the redirections still worked, and we were able to manually download a malware sample.<\/p>\n

\"Fake<\/p>\n

Figure 3. Downloaded malware sample<\/p>\n

All the malicious websites we examined had four things in common:<\/p>\n

\n