Users can be infected by the technique adding malicious file on installation file.
Therefore, for users who recently installed KMPlayer need to check security on his computer.
The most recent version of KMPlayer is KMPlayer_KR_3.0.0.1442_R2.exe noticed its official web site and posted on September 21st.
However, downloaded file on November 26th was tampered by someone and contained malicious file to install additionally. Tampered file looked like normal KMPlayer, but its file information contains Chinese language. Based on our analysis, creator of this program seems to be used Binder program, combine 2 execution files to 1 file.
Tampered KMPlayer_KR_3.0.0.1442_R2.exe contains malicious file SOURCE which contains "malicious resource code", and it will be installed on certain name and executed. Finally it will be infected by malicious file for attacking DDoS.
2. Spreading path and symptoms of infection
On executing tampered KMPlayer_KR_3.0.0.1442_R2.exe, it will create both normal and malicious install files on temp folder.
Since, both files are designated its name by (fixed+changeable alphabet), its name will be created differently every time.
* Combination of generating normal file(EXE) : e+(fixed)+a+(fixed)+l+(fixed)+r.exe
* Combination of generating malicious file(EXE) : l+(fixed)+a+(fixed)+l+(fixed)+r.exe
* Combination of generating malicious file(DLL) : T+(fixed)+m+(fixed)+t+(fixed)+D.dll
* Combination of generating malicious file(EXE) : l+(fixed)+a+(fixed)+l+(fixed)+r.exe
* Combination of generating malicious file(DLL) : T+(fixed)+m+(fixed)+t+(fixed)+D.dll
Upon executing normal KMPlayer installation file, it will ask user install language.
Malicious file will insert certain DLL file with hidden property in system folder
This malicious file is also masqueraded as Which Battery Meter Helper
Malicious file will insert certain DLL file with hidden property in system folder
This malicious file is also masqueraded as Which Battery Meter Helper
The latest version of nProtect Anti-Virus can detect it as Trojan/W32.DoS.67584.B.
Once infected by this kind of malicious file, attacker can connect victim's IP address and control with using remote management program.
Following figure is list of Zombie PCs. Numerous PCs can be infected and work as a DDoS Agent even be leaked personal information.
3. How to prevent
To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.
Security management tips
1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.
5. Execute downloaded file after scan with anti-virus SW.
1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.
5. Execute downloaded file after scan with anti-virus SW.
INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with “nProtect Anti-Virus/Spyware” for detecting such as malicious file stated above and runs responding system against various security threats.
Diagnosis name
- Virus/W32.Patched.V
- Trojan/W32.DoS.67584.B
تعتمد شركة ركن البيت على افضل الخدمات الاساسية المميزة التى تساعد فى الوصول الى افضل النتائج المميزة التى تؤدي الغرض المطلوب حيث لدينا شركة تنظيف بالرياض تساعد فى تحقيق افضل ما هو مطلوب في خدمات النظافة بعيد عن اعمال التنظيف اليدوية التي تستخدم اساليب فعليك ان تتعاون وتتصل بنا في شركتنا حيث يمكنك الاستعانة بخدمة تنظيف الفلل من خلال التواصل مع قسم شركة تنظيف فلل بالرياض التي تحقق كل ما هو جيد في اعمال التنظيف والسعى الى التنظيف من الالف الى الياء كما يوجد لدينا خدمات اخري في النظافة مثلا تنظيف الخزانات التي تحتاج الي مختص فني في تقديم اعمال نظافة الخزنات من خلال شركة تنظيف خزانات بالرياض
ReplyDeleteالتي لديها خدمة متخصصة في القضاء علي البكتريا والرواسب التي توجد في قاع الخزانات من خلال شركة تسمي المتميزة في التعقيم والتظهر للحصول علي كل ما هو صحي من خلال شراء اغلى انواع المنظفات والمساحيق والمعطرات المميزة التى تساعد فى الوصول الى اى نتيجة يرغب العميل بها فشركة ركن البيت هى افضل الشركات التى تهتم باعمال التنظيف لمنزلك التي توجد لديك مثل خدمة شركة تنظيف مسابح بالرياض مهما كانت مساحته ومهما كانت درجة الاتساخ فلاتتردد فى التعامل معنا لدينا خدمات اخري يمكنك متابعتها مثلا بعض الناس يعتمدون علي شركة مكافحة حشرات بالرياض والتي تعتبر من افضل الخدمات الاساسية داخل مدينة الرياض التي تحتاج عناية شديدة في اعمالها من خلال تعاملها مع قسم شركة رش مبيدات بالرياض والتي يستخدم مبيدات طبيعية والتي تقتل جميع الحشرات المنزلية مثل الصراصير والنمل الابض والفئران بالاضافة الى ان الشركة تهتم بتوفير افضل الخدمات الاساسية فى اعمال الرش فاذا كنت فى اى مكان وتعانى من وجود حشرات فعليك التخلص منه من خلال شركتنا المتميزة
نقدم لكم عملائنا الأعزاء شركة تسليك مجاري بالدمام
ReplyDeleteSet aside some time to discover this page on how to spy on phone without installing software.
ReplyDeletegreat post. thanks for sharing this information
ReplyDeleteKineMaster for pc
Free fire for pc
https://www.kinemasterforpcdownload.co/
https://www.freefirepcdownload.online/
This is beautiful place i really like her dress thank you so much. Cider apk Diskdigger Mi Account Unlock Tool
ReplyDeleteشركة بتبوك
ReplyDeleteشركة مكافحة حشرات بتبوك
شركة مكافحة النمل الابيض بتبوك
شركة رش مبيدات بتبوك
GREAT POST ADMIN THANKS FOR THIS REALLY WORTHY
ReplyDeletepubg for pc free download
pubg mobile pc
pubg for macbook
pubg lite for pc
pubg lite for mac
Thanks for sharing your thoughts, this blog is great. It is really useful and easy to understand. Hope everyone get benefit. Thanks for sharing your Knowledge and experience with us.
ReplyDeleteBrother Printer Support
download Instrumental
ReplyDeletedownload latest Naija Instrumental
download hip pop Instrumental
download dance hall Instrumental
rap Instrumental
Afrobeat Intrumental
pop Intrumental
Top Ten download latest Instrumental 2020
naijaflash
download Instrumental
download latest Naija Instrumental
download hip pop Instrumental
download dance hall Instrumental
rap Instrumental
Afrobeat Intrumental
pop Intrumental
Top Ten download latest Instrumental 2020
naijaflash
download Instrumental
download latest Naija Instrumental
download hip pop Instrumental
download dance hall Instrumental
rap Instrumental
Afrobeat Intrumental
pop Intrumental
Top Ten download latest Instrumental 2020
naijaflash
A virus is self-replicating: it contains code that copies itself into other files on the system.
ReplyDeletedeep nude app download
Browse all Instagram on the web, Instagram web viewer online, Picks the most popular hashtag and interesting users and story on Instagram viewer.
ReplyDeletevisite our site for more information about us
ReplyDeletetechiemag
Great article! We will be linking to this great article on our website. Keep up the good writing.
ReplyDeleteروش تحقیق در علوم رفتاری زهره سرمد روش تحقیق در علوم رفتاری زهره سرمد
روش تحقیق در علوم رفتاری زهره سرمد روش تحقیق در علوم رفتاری زهره سرمد
Wales publications are well-known publishing solution providers in various disciplines in the UK, Wales Publications serving to scientific organizations worldwide. Contact us for further information and know our best services and deals to achieve your goal.The fast submission process includes rapid publication research in UK that includes unique rapid process, inhouse peer review and 100% acceptance guarantee.
ReplyDeletekocaeli escort
ReplyDeleteizmit escort
gebze escort
kocaeli escort bayan
gebze escort
kocaeli escort
izmit escort
kurtköy escort
En güzel bayanların sitesi
ReplyDeleteİstanbul rus escort mu arıyosun ozaman giriş yap ve rus escort istanbul bul istanbul rus escort
şişli escort
istanbul vip escorts
ankara rus escort
paykwik
En güzel bayanların sitesi
ReplyDeleteİstanbul rus escort mu arıyosun ozaman giriş yap ve rus escort istanbul bul istanbul rus escort
şişli escort
istanbul vip escorts
ankara rus escort
paykwik