Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1054103" data-attributes="member: 32260">It seems that someone created malware (DarkComet family) that uses a modified Hard_Configurator installer. This malware is unsigned and slightly larger.Fortunately, even the original (made by me) unsigned version of Hard_Configurator usually triggers the AV detections, so I must always submit the H_C executables to AV vendors for whitelisting.&nbsp; The malware creator probably lost time without much gain.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Here is the VT link with current detections:&nbsp;<a href="https://www.virustotal.com/gui/file/3f5e3fbeff7fff9f6ac8ca46706dd6fd28a779e3f1394273f5dee0c58c8ce57d/details" target="_blank">VirusTotal</a>The original Hard_Configurator is:<ul>
<li data-xf-list-type="ul">digitally signed,</li>
<li data-xf-list-type="ul">accepted by SmartScreen + PUA in Edge and Explorer,</li>
<li data-xf-list-type="ul">accepted by Microsoft Defender (max settings),</li>
<li data-xf-list-type="ul">accepted by Smart App Control,</li>
<li data-xf-list-type="ul">accepted by all popular AVs (with the exception of the Enterprise version of Bitdefender which flags the NirSoft FullEventLogView as PUA).</li>
</ul>Edit.The VT info is insufficient, but it is possible that the original H_C is embedded in the malware body. In this case, the malware can run the malicious code and parallelly run the original H_C to masquerade the attack. Anyway, the malware is still unsigned, not accepted by SmartScreen and SAC, etc., but as the 0-day, it could fool some AVs.</blockquote>

[QUOTE="Andy Ful, post: 1054103, member: 32260"] It seems that someone created malware (DarkComet family) that uses a modified Hard_Configurator installer. This malware is unsigned and slightly larger. Fortunately, even the original (made by me) unsigned version of Hard_Configurator usually triggers the AV detections, so I must always submit the H_C executables to AV vendors for whitelisting. The malware creator probably lost time without much gain.:) Here is the VT link with current detections: [URL='https://www.virustotal.com/gui/file/3f5e3fbeff7fff9f6ac8ca46706dd6fd28a779e3f1394273f5dee0c58c8ce57d/details']VirusTotal[/URL] The original Hard_Configurator is: [LIST] [*]digitally signed, [*]accepted by SmartScreen + PUA in Edge and Explorer, [*]accepted by Microsoft Defender (max settings), [*]accepted by Smart App Control, [*]accepted by all popular AVs (with the exception of the Enterprise version of Bitdefender which flags the NirSoft FullEventLogView as PUA). [/LIST] Edit. The VT info is insufficient, but it is possible that the original H_C is embedded in the malware body. In this case, the malware can run the malicious code and parallelly run the original H_C to masquerade the attack. Anyway, the malware is still unsigned, not accepted by SmartScreen and SAC, etc., but as the 0-day, it could fool some AVs. [/QUOTE]

Verification