This week, the SonicWall Capture Labs Threat Research Team has analyzed a malware sample purporting to be a NordVPN installer but was also distributing a Trojan. Purporting to be a legitimate software while slipping in a malicious program is a behavior many malware authors utilize to trick unsuspecting users in installing malware to gain access to their systems. In this case, a user’s objective in installing the supposedly legitimate program might be to protect and secure their privacy online but instead gets the complete opposite.
Infection cycle:
The installer arrives as a winrar self-extracting archive using a legitimate NordVPN icon.
It drops the following files into the temp directory:
It executes nordvpnsetup.exe and installs the legitimate software, NordVPN, along with the appropriate .NET framework version if the system does not have this prerequisite program installed.
It then executes nord-sig.exe which uses the following icon and also pretends to be another legitimate software.
It performs a slew of malicious actions which include the following:
The intention of this Trojan is clear. We urge our users to always be vigilant and cautious when installing software programs particularly if you are not certain of the source.
SonicWall Capture Labs provides protection against this threat via the following signatures:
This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.
With millions of stolen credentials currently up for sale, the time for stronger authentication is now. In “Star Trek: The Next Generation,” Jean-Luc Picard famously said, “It is possible to commit no mistakes and still lose.” This applies to many...
A solid password is instrumental to keeping your important accounts and information safeguarded. October is typically associated with pumpkin spice lattes, college football, crunching leaves underfoot and ghostly fun, but did you know it’s also Cybersecurity Awareness Month? This is...
While phishing attacks can be scary, not knowing how to recognize them is even scarier. October brings to mind three things: busting out the fall wardrobe, Halloween and, last but not least, cybersecurity awareness. If you read that list and...
Designed for home offices and lean branches, the TZ270 series deliver industry-validated security effectiveness with best-in-class price-performanc...
View full details
The SonicWall TZ570 series, is the first desktop-form factor next-generation firewall (NGFW) with 5 Gigabit Ethernet interfaces. Designed for mid...
View full details
The SonicWall TZ670 series, is the first desktop-form factor next-generation firewall (NGFW) with 10 Gigabit Ethernet interfaces. Designed for mi...
View full details
Designed for small organizations and distributed enterprise with SD-Branch locations, the TZ470 series deliver industry-validated security effectiv...
View full details
Designed for small organizations and lean branches, the TZ370 series deliver industry-validated security effectiveness with best-in-class price-per...
View full details
