For a few years now, copyright holders have warned that people who use pirate sites risk running into malware and other malicious content.
These warnings are meant to dissuade people from using these sites. However, a new type of malware already does that in a more direct way.
In an article published this week, British security company Sophos highlights a malware campaign that actively targets pirates. Not to harm their computers, but to block them from accessing pirate sites in the future.
Disguised as Pirated Software
The malware in question is disguised as pirated software and is shared on regular torrent sites and other places. The packages look like regular ‘cracked’ releases but those who try to install the software are in for a surprise.
Instead of installing a cracked version of the software users were looking for, the malware triggers a fake error message which mentions that a DLL file is missing.
“The program can’t start because MSVCR100.dll is missing from your computer. Try reinstalling the program to fix this problem,” the error reads while executing the malware in the background.
Once executed, the malware tries to contact the 1flchier[dot]com domain, which is a typo variation of the file-sharing site 1fichier. When successful, it downloads a new payload titled ‘ProcessHacker.jpg,’ while sharing the filename of the pirated software the victim was planning to use.
It is unclear if this data is being used for anything but at the moment, the malicious domain is no longer accepting requests. However, it appears that the malware has been in use for several months at least, so this may have been different in the past.
Blocking Hundreds of Pirate Sites
Where the malware really shines, is when it actively modifies the ‘hosts’ file on users’ computers. This file can be used to override how domain names resolve. The attackers use it to link a few hundred to over a thousand pirate domain names to the localhost address, 127.0.0.1.
This change effectively blocks victims from accessing the sites, which includes The Pirate Bay and many of its proxies.
Interestingly, this isn’t the first time we’ve seen malware do this. More than a decade ago a similar threat was widely shared on torrent sites. This also modified the ‘hosts file‘ to block The Pirate Bay. In addition, it also triggered popups that played a sound file saying that “downloading is wrong”.
Sophos has no idea who is behind the malware and neither have we. While it could be an interesting anti-piracy strategy, it’s unlikely that the malware comes from that angle. It could just as easily come from a rival pirate site that is not on the blocklist.
Easily Fixed
In any case, Sophos reports that its software blocks the threat, so its users are safe. Also, people whose computers are compromised can easily fix the problem themselves too.
“Users who have inadvertently run one of these files can clean up their HOSTS file manually, by running a copy of Notepad elevated (as administrator), and modifying the file at c:\Windows\System32\Drivers\etc\hosts to remove all the lines that begin with “127.0.0.1” and reference the various ThePirateBay (and other) sites,” Sophos writes.
