Adrozek

Microsoft says that, currently, the malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software.

These malicious scripts connect to the attacker’s server to fetch additional scripts, which are responsible for injecting advertisements into search results.

The malware also tampers with certain browser DLLs. For instance, on Microsoft Edge, it modifies MsEdge.dll to turn off security controls that are crucial for detecting any changes in the Secure Preferences file.

It stores its configuration parameters at the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\<programName>. The ‘tag’ and ‘did’ entries contain the command-line arguments that it uses to launch the main payload.

If any of these browsers are found on infected hosts, the malware will attempt to force-install an extension by modifying the browser's AppData folders.

The malware is installed like a usual program that can be accessed through Settings>Apps & features, and registered as a service with the same name... To maintain persistence, the malware creates a service named “Main Service”.

The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.

The Secure Preferences file is similar in structure to the Preferences file except that the former adds hash-based message authentication code (HMAC) for every entry in the file... Adrozek goes one step further and patches the function that launches the integrity check.

The malware is installed like a usual program that can be accessed through Settings>Apps & features, and registered as a service with the same name... To maintain persistence, the malware creates a service named “Main Service”.

The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.

Each of these files is heavily obfuscated and uses a unique file name that follows this format: setup_<application name>_<numbers>.exe.

All in all, due to its prolific use of polymorphism to constantly rotate its malware payloads and distribution infrastructure, Microsoft expects the Adrozek operation to grow even more in the coming months.

This file in drops the main payload in the Program Files folder using a file name that makes it look like a legitimate audio-related software. We have observed the malware use various names like Audiolava.exe, QuickAudio.exe, and converter.exe.

The malware also tampers with certain browser DLLs. For instance, on Microsoft Edge, it modifies MsEdge.dll to turn off security controls that are crucial for detecting any changes in the Secure Preferences file.

It stores its configuration parameters at the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\<programName>. The ‘tag’ and ‘did’ entries contain the command-line arguments that it uses to launch the main payload.

The Secure Preferences file is similar in structure to the Preferences file except that the former adds hash-based message authentication code (HMAC) for every entry in the file... Adrozek goes one step further and patches the function that launches the integrity check.

But the real threat is how the malware can also steal login credentials from the Firefox browser, and potentially give hackers a launching pad for more damaging crimes.

On Mozilla Firefox, the said file... stores user credentials in encrypted form... The malware looks for specific keywords like encryptedUsername and encryptedPassword to locate encrypted data. It then decrypts the data using the function PK11SDR_Decrypt() within the Firefox library and sends it to attackers.

The Secure Preferences file is similar in structure to the Preferences file except that the former adds hash-based message authentication code (HMAC) for every entry in the file... Adrozek goes one step further and patches the function that launches the integrity check.

It then starts locating specific files, including login.json... stores user credentials in encrypted form and the browsing history.

But the real threat is how the malware can also steal login credentials from the Firefox browser, and potentially give hackers a launching pad for more damaging crimes.

These malicious scripts connect to the attacker’s server to fetch additional scripts... The malware also sends information about the device to the said remote server.

These malicious scripts connect to the attacker’s server to fetch additional scripts... On Mozilla Firefox, Adrozek takes things further. It downloads an additional randomly named .exe file.

Microsoft says that on Firefox, Adrozek also contains a secondary feature that extracts credentials from the browser and uploads the data to the attacker's servers.

Adrozek goes one step further and patches the function that launches the integrity check. The two-byte patch nullifies the integrity check... On Google Chrome or Microsoft Edge, the malware modifies... safebrowsing false.