Fake Adobe Flash Update Sites Pushing CPU Miners

Haythem Elmir

If you have ever been infected or have helped someone infected with adware, then you most likely have seen your browser being redirected to sites pretending to be Flash Player updates. Instead of a legitimate update, these sites normally push adware bundles that install further unwanted programs on an unsuspecting user. Today, I learned about a new fake Flash Player update site, but was surprised to find that it was installing a CPU miner instead onto visitors.

When a user visits this Flash Player update site, the site will automatically initiate a download to the computer. While the page above is obviously pushing a Flash Player update scam, when I tested it, the file that was downloaded was named java-player.exe instead.

Based on this VirusTotal scan, I expected it would installed adware or PUPs when executed on a computer. Instead, the executable installed a CPU miner called SystemProcess that quickly used up all the available processing power on the computer.

SystemProcess Exec in Task Manager
SystemProcess Exec in Task Manager

When installed, a new schedule task called SystemProcess is created that launches the miner executable when a user logs into the computer.

Thankfully, this particular miner is detected by a large amount of security products, so if you weren’t protected by an existing software, you can download and install Malwarebytes or Emsisoft and clean it up for free.

How to protect yourself from these types of scams

Unfortunately, people fall for scam sites like this all the time. The best advice I can give when you encounter a site telling you a program is out of date and offers a downloadable update is to immediately close the web page. You should only download and install updates from highly trusted sites, and even then, I would still suggest that you go directly to the software developer for updates.

Be careful and be safe. It is dangerous place on the Net if you are not careful.
To read the original article:



Laisser un commentaire

Next Post

ADB.Miner worm is rapidly spreading across Android devices

A fresh threat to Android devices has managed to infect thousands of devices in days, researchers warn. In a blog post published Sunday, cybersecurity researcher Wang Hui from 360Netlab said a strain of cryptocurrency mining malware called ADB.Miner has begun spreading rapidly. The malware has similar capabilities to worms and […]