Hello everyone, today we're taking a look at... something new! Yeah.
It's not old, this actually just came out earlier tonight; August 2nd, I guess it's just after midnight here
but yeah, this just happened a few hours ago.
I know a lot of people always ask for modern malware, and now here's something that's right up my alley.
So, I actually got a DM about this on Twitter, about 5 hours ago
telling me that "Classic Shell official download has been infected, it does this to any PC you run it on; warn your viewers".
By the time I got around to actually downloading it and checking it out, everything seemed to be normal
I certainly didn't see this incredibly intriguing screen pop up on my virtual machine, however I was definitely interested.
So... I ended up contacting the Twitter handle that is listed in that image,
and to my surprise they got back to me very quickly, and hooked me up with a sample to test.
So here we have the clean copy of Classic Shell, the setup program
and in here we have the infected copy.
Notice how it's named exactly the same, same icon...
and, if we take a look the size is just very slightly different...
...6.81 Megabytes vs 6.88.
So, unless you were really paying attention looking at the hash,
you might overlook this and end up running this if you had downloaded
it expecting Classic Shell.
When we run the official installer,
we go through everything quite normally, everything installs very easily, quickly...
...and once it's installed, we now have our
classic start menu on Windows 8.
So, that all works perfectly fine.
Now, if you had visited the site during the time it was infected,
you would have received this file. And when we run this,
[WINDOWS ALERT SOUND]
we'll say yes, go ahead and allow it to make changes
and a window pops up and nothing appears to happen.
And some people I know like to look on VirusTotal
to see if what they downloaded is malicious, or anything like that, but
take a look at some of these results, this is virtually undetected.
Only a few detections and all of these are just generic
'you-don't-want-this-on-your-computer' detections, nothing specific.
So this is definitely brand new.
Apparently, along with the infected copy of Classic Shell, they also uploaded an infected copy of Audacity
to FossHub, which apparently they gained access to to replace these files.
and serve up these malware downloads.
So now we're gonna go ahead and reboot,
'cause I know we all wanna see that message
And, once we boot up here, instead of Windows we get the message:
AS YOU REBOOT, YOU FIND THAT SOMETHING HAS OVERWRITTEN YOUR MBR (Master Boot Record)! IT IS A SAD THING YOUR ADVENTURES HAVE ENDED HERE!
DIRECT ALL HATE TO PEGGLECREW (@CULTOFRAZER ON TWITTER) and then a bunch of 'GREETZ'.
So, this is very, very nostalgic here,
if you've watched my channel for any length of time you've seen many, many pieces of malware do stuff very similar to this
and this is pretty unheard of in this day and age, especially for something that's out in the wild
and has actually infected people who are talking about thison the internet, on the forums trying to get it off their machines, what have you.
Now,
fixing this... is not too difficult.
This does not intentionally damage data that I've seen, or that they've actually said,
as far as I've seen this just overwrites your MBR, which is a pretty simple fix
I'm gonna go ahead and try to do that
So now we're actually booting into the uh Windows 8.1 Recovery CD, just the installation media
And I was able to repair this pretty simply before.
if we go to 'Repair Your Computer',
then 'Troubleshoot',
then 'Advanced', use the command prompt to [write]...
"bootrec /fixmbr"
and then, if we exit out of this...
and run the 'Startup Repair'...
that worked just fine for me, we'll see if it works this time.
and hey, here we go, it appears to have worked.
We are actually booting into Windows instead of our
message on the master boot record.
So, all my files are still here,
the desktop is exactly as I left it
everything seems to be in order, so
some people have said they had to wipe their drives
With stuff like this, anything really goes
sometimes you run into unintentional side effects, when your malware infects things in the wild
and stuff that's supposed to not damage anything can end up doing
lots of damage, but in this case, for me personally,
I haven't seen anything that indicates a vast amount of damage.
Now there could be any number of password stealing, or
or credential stealing or any other thing bundled with this, as with any undetected malware
but from what I've seen, from what they've said on Twitter,
it's not the end of the world, however it's definitely a warning
that sites can easily become compromised, and that things you download like this can end up doing scary stuff to your computer
So, definitely an interesting case,
definitely something I was interested in taking a look at,
hopefully you are not hit by this, hopefully a future site intrusion does not occur
and you have to deal with something like this
but
that is about it, there are some extra removal instructions in case my tips didn't work for you in the description,
they were sent to me by "@br3akth3lim1t" on twitter,
so if you are affected by this, check them out, maybe they can help you.
So, thank you for watching, that's about it, take care.
"BLOOPER IN WHICH VIRTUALBOX SUCKS"
And, once we finish booting into Windows here,
{{Why do these hackers w/ Twitter accounts always think they're the hot shit and always have a case of elitism? No one really likes you, they just like seeing what you do.}}
I hate VirtualBox so much.