Fruity trojan downloader performs multi-stage infection of Windows computers
news.drweb.com
Doctor Web has uncovered an attack on Windows users involving a modular downloader trojan dubbed Trojan.Fruity.1. With its help, threat actors can infect computers with different types of malware, depending on the attackers’ goals. To conceal an attack and increase the chances of it being successful, they use a variety of tricks. These include a multi-stage infection process for target systems, using harmless apps for launching components of the trojan, and trying to bypass anti-virus protection.

Summary

What is Trojan.Fruity.1?

  • A modular downloader trojan that can be used to distribute other malware.
  • Distributed through malicious websites and software installers that appear to be legitimate.
  • Once installed, Trojan.Fruity.1 begins a multi-stage infection process that can ultimately lead to the installation of the Remcos RAT spyware.

How does it work?

  • The trojan is implanted into legitimate programs, such as Python libraries, VLC mediaplayer, and VMWare virtualization software.
  • The trojan uses a variety of techniques to evade detection, including encryption, steganography, and process hollowing.
  • The trojan can be used to infect computers with other malware, such as ransomware, cryptominers, and backdoors.

How to prevent infection?

  • Only download software from trusted sources.
  • @Raisin8659OPEnglish
    11•1 year ago

    Yes, for home, if you are not installing ad-blockers for all your family members, you can set AdGuard DNS, etc., as DNS servers on your router to somewhat mitigate the ad/malware/scam problem for the entire location.