“HotRat” distribution within illegal software

Topic

New Reply

Tagged ‘HotRAT’ by cybersecurity analysts at Avast, this has been targeting netizens who download cracked and pirated software like popular games and utilities.This disables certain AV suites once the payload is injected via cracked/pirated software.

There’s quite a large list of well known and used cracked software, but one caught my eye (which belongs to Avast!) CCleaner Professional.

Avast is also one of the AV’s that gets a targeted load to ammend security features along with Malwarebytes, AVG and McAfee.

For more info and list of software:

https://decoded.avast.io/martinchlumecky/hotrat-the-risks-of-illegal-software-downloads-and-hidden-autohotkey-script-within/

Windows - commercial by definition and now function...

2 users thanked author for this post.

Alex5723, Fred

Reply | Quote

Replies

ooops when trying to open this link ‘-(

* _ ... _ *

Reply | Quote

That site is clean on VirusTotal and it doesn’t use any cookies. MB is being over sensitive methinks.

cheers, Paul

Reply | Quote

Alex5723 wrote:

The link works fine with Chrome, Firefox ESR and Kaspersky

It isn’t about working fine or not; once the RAT is exploited “all works fine” so to speak.
The warning from Malwarebytes is about: “Riskware or risky software” and describes legitimate software programs that contain loopholes or vulnerabilities that can be “exploited by hackers for malicious purposes.”
So, if you do not mind, I will NOT (partially) disable Malwarebytes Premium but take their advice and leave this site alone.

The site gives this info in the attached pdf:

HotRat_-The-Risks-of-Illegal-Software-Downloads-and-Hidden-AutoHotkey-Script-Within-Avast-Threat-Labs

About the statement “and it doesn’t use any cookies“, check again: <https|decoded|avast|io> for sure uses =>> cookie, tracker, tracer, header referrers, webpage scripting and finger printing.

xx

* _ ... _ *

Reply | Quote

You get HotRat by running illegal software, not by visiting the Avast web site.

cheers, Paul

2 users thanked author for this post.

Microfix, Alex5723

Reply | Quote

..

* _ ... _ *

Reply | Quote

The link works fine with Chrome, Firefox ESR and Kaspersky

Reply | Quote

link is fine here, reading the description, malwarebytes can be used against the user too if infected.

Reply | Quote

[Fred]

@Alex5723 : see #2575200  please

* _ ... _ *

• This reply was modified 1 year, 10 months ago by Fred.
• This reply was modified 1 year, 10 months ago by Fred.

Reply | Quote

Paul T wrote:

That site is clean on VirusTotal and it doesn’t use any cookies. MB is being over sensitive methinks.

cheers, Paul

Really?

* _ ... _ *

Reply | Quote

Fred wrote:

Malwarebytes

I see that Malwarebytes warning as a false positive.

Reply | Quote