IOBit forum hacked (?) "Free 1 year license" ransomware link sent to hundreds

[tysroby]

This is a post from https://www.bleepingcomputer.com/

 

Quote

A few weeks ago, I registered to the IOBit Software Support Forums to report a bug in their software. Yesterday, I received an email (appearing to be) from them awarding forum members "a free 1-year license" with download link.

 

I'm usually a tech savvy guy and know better to download/run strange software, but everything looked legit (email address, artwork, link on their URL), so I downloaded the "freebie" patch that all alleged to register my IOBit software.

 

Hours later, my computer was completely trashed. Fortunately, I backup my boot drive every month and was able to get a working system again, but the damage the malware did was extensive and I need help recovering.

 

The malware went through my computer and changed the extension of over 121K files to ".DeroHE". Worse, it either corrupted the headers of those files or they are only fragments of files.

 

Text files are no problem. Simply change the extension to ".txt". But thousands of other files were not only renamed, but the file type was stripped from the header (bmp, ico, png, jpg, zip, rar, pdf... you name it. Trashed.) Trashed files can't be even be identified by examining the header in "Notepad++". Source code files belonging to my "Visual Studio" projects also trashed. The damage (and possible loss) is extraordinary.

 

And "Windows Defender" missed it all. 

 

To recover from this disaster, I need two things: A utility that can identify/fix the now unidentifiable files, and a program that can find & rename every file whose extension was changed (preferably one program that can do both.) Do you know how long it would take to go through 121K+ files by hand, identify them (if possible) and rename them? Just the text messages alone would take ages. 

 

I'm beyond pissed. Even the "IOBit" website appears to be down as I tried to report the problem (either hacked or they took it down themselves till they remedy the hack.)

 

SOURCE: https://www.bleepingcomputer.com/forums/t/741190/help-iobit-forum-hacked-free-1-year-license-malware-link-sent-to-hundreds/

 

 

 

[andy2004]

You could try TrID to rename the files.. it works from Dos and is small. free

 

TrId homepage link

[BigBear]

I received this email but Gmail snagged it into spam,thats where its staying.

[mood]

IObit forums hacked in widespread DeroHE ransomware attack

 

 

Windows utility developer IObit was hacked over the weekend to perform a widespread attack to distribute the strange DeroHE ransomware to its forum members.

 

IObit is a software developer known for Windows system optimization and anti-malware programs, such as Advanced SystemCare.

 

Over the weekend, IObit forum members began receiving emails claiming to be from IObit stating that they are entitled to a free 1-year license to their software as a special perk of being a forum member.

 

IObit 'Promo' email

 

Included in the email is a 'GET IT NOW' link that redirects to hxxps://forums.iobit.com/promo.html. This page no longer exists, but at the time of the attack, it was distributing a file at hxxps://forums.iobit.com/free-iobit-license-promo.zip.

 

This zip file [VirusTotal] contains digitally signed files from the legitimate IObit License Manager program, but with the IObitUnlocker.dll replaced with an unsigned malicious version shown below.

 

Malicious IObitUnlocker.dll DLL

Source: BleepingComputer

 

When IObit License Manager.exe is executed, the malicious IObitUnlocker.dll will be executed to install the DeroHE ransomware to C:\Program Files (x86)\IObit\iobit.dll [VirusTotal]and execute it.

 

As most executables are signed with IOBit's certificate, and the zip file was hosted on their site, users installed the ransomware thinking it was a legitimate promotion.

 

Based on reports at IObit's forum and other forums [1, 2], this is a widespread attack that targeted all forum members.

A closer look at the DeroHE ransomware

BleepingComputer has since analyzed the ransomware to illustrate what happens when executed on a victim's computer.

 

When first started, the ransomware will add a Windows autorun named "IObit License Manager" that launches the "rundll32 "C:\Program Files (x86)\IObit\iobit.dll",DllEntry" command when logging in to Windows.

 

Emsisoft analyst Elise van Dorp, who also analyzed the ransomware, stated the ransomware adds the following Windows Defender exclusions to allow the DLL to run.

@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"
@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"\Temp\\"
@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionExtension=\".dll\"
@WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionProcess=\"rundll32.exe\"

The ransomware will now display a message box claiming to be from IObit License Manager stating, "Please wait. It may take a little longer than expected. Keep your computer running or screen on!' The ransomware shows this alert to prevent victims from shutting off their devices before the ransomware finishes.

 

Fake alert to not turn off the computer

Source: BleepingComputer

 

When encrypting victims, it will append the .DeroHE extension to encrypted files.

 

Files encrypted by the DeroHE ransomware

Source: BleepingComputer

 

Each encrypted file will also have a string of information appended to the end of the file, as shown below. The ransomware may use this information to decrypt files if a ransom is paid.

{"version":"3","id":"dERiqiUutvp35oSUfRSTCXL53TRakECSGQVQ2hhUjuCEjC6zSNFZsRqavVVSdyEzaViULtCRPxzRwRCKZ2j2ugCg5r9SrERKe7r5DVpU8kMDr","parts":[{"size":193536,"esize":193564,"offset":0,"rm":"Phj8vfOREkYPKA9e9qke1EIYOGGciqkQBSzfzg=="}],"ext":".png"}

 

Hex edit of an encrypted file

Source: BleepingComputer

 

On the Windows desktop, the DeroHE ransomware will create two files named FILES_ENCRYPTED.html, containing a list of all encrypted files, and the READ_TO_DECRYPT.html ransom note.

 

The ransom note has the title of 'Dero Homomorphic Encryption,' and promotes a cryptocurrency called DERO. This note tells the victim to send 200 coins, worth approximately $100, to the listed address to get a decryptor.

 

DeroHE ransomware ransom note

Source: BleepingComputer

 

Enclosed in the ransom note is the ransomware's Tor site http://deropayysnkrl5xu7ic5fdprz5ixgdwy6ikxe2g3mh2erikudscrkpqd.onion, which can be used to make the payment.

 

Of particular interest, the Tor site states that IObit can send $100,000 in DERO coins to decrypt all victims, as the attackers blame IObit for the compromise.

"Tell iobit.com to send us 100000 (1 hundred thousand) DERO coin to this address. dERopYDgpD235oSUfRSTCXL53TRakECSGQVQ2hhUjuCEjC6zSNFZsRqavVVSdyEzaViULtCRPxzRwRCKZ2j2ugCg26hRtLziwu"

"After payment arrive, all encrypted computer (including yours) will be decrypted. THIS IS IOBIT's FAULT to made your computer getting infected," the DeroHE Tor payment site states.

 

Dero Ransomware Tor payment site

Source: BleepingComputer

 

The ransomware is being analyzed for weaknesses, and it is not known if it can be decrypted for free.

Furthermore, it is unknown if the threat actors will keep their word and provide a decryptor if payment is made.

IObit forums likely compromised

To create the fake promotion page and host a malicious download, the attackers likely hacked IObit's forum and gained access to an administrative account.

 

At this time, the forums still appear to be compromised, as if you visit missing pages that return a 404 error code, the web page will display dialogs to subscribe to browser notifications. Your browser will begin to receive desktop notifications promoting adult sites, malicious software, and other unwanted content when subscribed.

 

Compromised IObit forum page

Source: BleepingComputer

 

Furthermore, if you click anywhere on the page, a new tab will open showing advertisements for adult sites. Other site sections also appear to be compromised as clicking on forum links redirect you to similar adult pages.

 

Attackers compromised the forum by injecting a malicious script on all pages that are not found, as shown below.

 

Compromised IObit forum page

Source: BleepingComputer

 

BleepingComputer has reached out to IObit with questions related to this attack but has not heard back.

 

 

Source: IObit forums hacked in widespread DeroHE ransomware attack