{"id":6883,"date":"2017-03-07T09:12:10","date_gmt":"2017-03-07T17:12:10","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/07\/news-674\/"},"modified":"2017-03-07T09:12:10","modified_gmt":"2017-03-07T17:12:10","slug":"news-674","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/03\/07\/news-674\/","title":{"rendered":"A multi-purpose fake online scanner"},"content":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Tue, 07 Mar 2017 16:00:14 +0000<\/strong><\/p>\n<p>Just to show you that behind some PUPs there are threat actors that are too lazy to be bothered, we offer you a fake online scanner that was used to promote the infamous <a href=\"https:\/\/blog.malwarebytes.com\/puppum\/2016\/08\/pup-friday-mackeeper\/\" target=\"_blank\">MacKeeper<\/a> and a Windows system optimizer called Advance-System-Care.<\/p>\n<h3><strong>Windows<\/strong><\/h3>\n<p>The redirect scheme on a Windows machine looked like this.<\/p>\n<p>From a compromised website we were re-directed to systemcheck[.]club where we got this popup:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16600\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/trick.png\" alt=\"\" width=\"475\" height=\"229\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/trick.png 475w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/trick-300x145.png 300w\" sizes=\"auto, (max-width: 475px) 100vw, 475px\" \/><\/p>\n<p>Clicking \u201cOK\u201d offered to start an online scan &#8211;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16601\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning1.png\" alt=\"\" width=\"719\" height=\"606\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning1.png 719w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning1-300x253.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning1-600x506.png 600w\" sizes=\"auto, (max-width: 719px) 100vw, 719px\" \/>-which claimed to find a HIGH risk virus:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16602\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning2.png\" alt=\"\" width=\"721\" height=\"538\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning2.png 721w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning2-300x224.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning2-600x448.png 600w\" sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/p>\n<p>Thankfully these helpful people knew just the tool to remove this virus from our PC and brought us to www[.]advancepctools[.]info:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16603\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning5.png\" alt=\"\" width=\"1261\" height=\"600\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning5.png 1261w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning5-300x143.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/warning5-600x285.png 600w\" sizes=\"auto, (max-width: 1261px) 100vw, 1261px\" \/><\/p>\n<p>Here we installed Advance-System-Care which did not find the virus, but nevertheless had some very important tips on how to improve the system\u2019s performance.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-16604 aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/main.png\" alt=\"\" width=\"786\" height=\"585\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/main.png 786w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/main-300x223.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/main-600x447.png 600w\" sizes=\"auto, (max-width: 786px) 100vw, 786px\" \/><\/p>\n<p style=\"text-align: center\"><em>Pro tip: that phone number will not work as there is a format error in it.<\/em><\/p>\n<p>That Advance-System-Care did not find the alleged virus is not surprising as Tapsnake is an Android infection that doesn&#8217;t work on Windows machines.<\/p>\n<p>One other thing that did puzzle me, was that I also got this prompt while visiting the systemcheck[.]club site:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-16605 aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/IEonMAC.png\" alt=\"\" width=\"414\" height=\"311\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/IEonMAC.png 414w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/IEonMAC-300x225.png 300w\" sizes=\"auto, (max-width: 414px) 100vw, 414px\" \/><\/p>\n<p style=\"text-align: center\"><em>A Windows Internet Explorer prompt letting me know that: \u201cVIRUS FOUND. It is necessary repair your Mac. Please do not leave the page. Click OK to begin the repair process.\u201d<\/em><\/p>\n<p>But when I showed this to our Mac researchers they had a very plausible explanation for this. Exactly the same fake scan is used to push MacKeeper on Mac systems.<\/p>\n<h3><strong>Mac<\/strong><\/h3>\n<p>My colleague\u00a0<a href=\"https:\/\/twitter.com\/thomasareed\" target=\"_blank\">@thomasareed<\/a> recorded the proceedings on a Mac system, leading to the install of MacKeeper:<\/p>\n<p><iframe  src='https:\/\/www.youtube.com\/embed\/BjUhGJFnrwY?version=3&#038;rel=1&#038;fs=1&#038;autohide=2&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;wmode=transparent' width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <br \/> As you can see the scan and the scan-results are exactly the same. Only MacKeeper is consistent by finding the same threat (Tapsnake) on the system.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16606\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/MacKeeper-Tapsnake-chat.png\" alt=\"\" width=\"1020\" height=\"770\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/MacKeeper-Tapsnake-chat.png 1020w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/MacKeeper-Tapsnake-chat-300x226.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/MacKeeper-Tapsnake-chat-600x453.png 600w\" sizes=\"auto, (max-width: 1020px) 100vw, 1020px\" \/><\/p>\n<h3><strong>Conclusion<\/strong><\/h3>\n<p>Although this setup seems to be designed for Mac users, it must have been considered a waste to not do anything with the Windows users that got sucked in. So a redirect was designed to provide a PUP system optimizer for these users.<\/p>\n<h4><strong>Detection and protection<\/strong><\/h4>\n<p>The site hosting the fake scanner and all the next steps in the redirection chain are blocked by Malwarebytes Premium <a href=\"https:\/\/blog.malwarebytes.com\/101\/2016\/08\/explained-the-malwarebytes-website-protection-module\/\" target=\"_blank\">Web Protection module<\/a>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16607\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/protection2.png\" alt=\"\" width=\"423\" height=\"312\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/protection2.png 423w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/protection2-300x221.png 300w\" sizes=\"auto, (max-width: 423px) 100vw, 423px\" \/><\/p>\n<p>The <a href=\"https:\/\/www.virustotal.com\/en\/file\/164cb18150d242e88de70b9f0e35478ab9aab88e0b723472dfdc278f6ea025da\/analysis\/\" target=\"_blank\">installer for Advance-System-Care<\/a> is detected as PUP.Optional.AdvanceSystemCare<\/p>\n<p>SHA256: 164cb18150d242e88de70b9f0e35478ab9aab88e0b723472dfdc278f6ea025da<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-16608\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/protection1.png\" alt=\"\" width=\"422\" height=\"280\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/protection1.png 422w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/03\/protection1-300x199.png 300w\" sizes=\"auto, (max-width: 422px) 100vw, 422px\" \/><\/p>\n<p>Malwarebytes removes Advance-System-Care completely. A <a href=\"https:\/\/forums.malwarebytes.com\/topic\/196979-removal-instructions-for-advance-system-care\/\" target=\"_blank\">removal guide for Advance-System-Care<\/a> can be found on our forums.<\/p>\n<p>&nbsp;<\/p>\n<p>Special thanks to <a href=\"https:\/\/twitter.com\/thomasareed\" target=\"_blank\">@thomasareed<\/a> for sharing his research on the Mac side and <a href=\"https:\/\/twitter.com\/MysteryFCM\">@MysteryFCM<\/a> for pointing out the URL.<\/p>\n<p>&nbsp;<\/p>\n<p><em>Pieter Arntz<\/em><\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/03\/drafta-multi-purpose-fake-online-scanner\/\">A multi-purpose fake online scanner<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/03\/drafta-multi-purpose-fake-online-scanner\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Tue, 07 Mar 2017 16:00:14 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/03\/drafta-multi-purpose-fake-online-scanner\/' title='A multi-purpose fake online scanner'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2015\/12\/laptop-notebook-technology-computer-large.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>Just to show you that behind some PUPs there are threat actors that are too lazy to be bothered, we offer you a fake online scanner that was used to promote the infamous MacKeeper and a Windows system optimizer called Advance-System-Care.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/\" rel=\"category tag\">Cybercrime<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/malware\/\" rel=\"category tag\">Malware<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/advance-system-care\/\" rel=\"tag\">advance-system-care<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/fake\/\" rel=\"tag\">fake<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/mackeeper\/\" rel=\"tag\">MacKeeper<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/online-scan\/\" rel=\"tag\">online scan<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/pieter-arntz\/\" rel=\"tag\">Pieter Arntz<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/03\/drafta-multi-purpose-fake-online-scanner\/' title='A multi-purpose fake online scanner'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/03\/drafta-multi-purpose-fake-online-scanner\/\">A multi-purpose fake online scanner<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[11538,4503,11539,11540,3764,11541,10523],"class_list":["post-6883","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-advance-system-care","tag-cybercrime","tag-fake","tag-mackeeper","tag-malware","tag-online-scan","tag-pieter-arntz"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6883"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6883\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}