Malware News Fauxpersky Keylogger masqueraded as Kaspersky Antivirus and spreads via USB drives

[LASER_oneXM]

Content source

https://securityaffairs.co/wordpress/70840/malware/fauxpersky-keylogger.html

Security researchers at Cybereason recently discovered a credential-stealing malware dubbed Fauxpersky, that is masquerading as Kaspersky Antivirus and spreading via infected USB drives.

Fauxpersky was written in AutoIT or AutoHotKey, which respectively are a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting and a free keyboard macro program to send keystrokes to other applications.

The analysis of infected systems revealed the existence of four dropped files, attackers named them as Windows system files: Explorers.exe, Spoolsvc.exe, Svhost.exe, and Taskhosts.exe.
After initial execution, the Fauxpersky keylogger gathers the listed drives on the machine and starts replicating itself to them.

“This AHK keylogger utilizes a fairly straightforward method of self propagation to spread. After the initial execution, the keylogger gathers the listed drives on the machine and begins to replicate itself to them. Let’s examine the process:” reads the analysis.
“This allows the keylogger to spread from a host machine to any connected external drives. If the keylogger is propagating to an external drive, it will rename the drive to match it’s naming scheme.”

 

[L0ckJaw]

Fauxpersky getting kicked by Kaspersky _

 

[Andytay70]

I'm avoiding anything with "persky" in it now!

 

[Deleted member 65228]

I'm avoiding anything with "persky" in it now!

Why? Kaspersky aren't involved with this except flagging it as malicious software to protect their customers.

You're using Avast according to your configuration. If a malware author were to brand something using part of the Avast name, you'd suddenly stop using it and would avoid them?

Malware authors do these things all the time, and even more common method is stealing their logos and pretending they were certified by them. Only the other day I found a scare-ware campaign attempting to infringe on Microsoft to push PUPs/PUAs.