The update server of the famous anti-virus eScan has been hacked.

The update server of the eScan loud anti-virus has been hacked to serve as a malware release point.

Although cyberprotection does not have the best tools to protect, choosing a tool developed by a well-known company is a good choice if the user's knowledge is not very deep, but now even using a tool from a well-known developer is risky.

According to a report by the website, The Hacker News mentioned an incident in which a server to update the software for malware protection, MicroWorld Technologies, from India, was hacked by hackers to release malware. The malware is downloaded via the update system installed on the victim's machine instead of the update for the eScan software version, which can be considered a type of supply chain attack or Supply Chain Attack.

The attack was detected. MicroWorld Technologies has revealed that it has detected unauthorized access to the server in the past 20 January. The hackers have customized that those who have updated it "for a specified period of time," a period of about two hours, will receive an update containing contaminated malware to install it on the machine. After the detection company has suspended the update system with a single Isolatation, the server with a disconnect for at least 8 hours. Hours and hours after the new update, the company issued a patch to fix the problems for users and advised the active organization to contact the company to receive patches for users at the enterprise level immediately.

A research team from cybersecurity firm Morphisec has revealed information about a malware-contaminated update that the payload will disrupt the normal operation of the eScan software and will lead to another payload called "Reload.exe." This payload will act to place another malware on the system and create persistence on the system, block remote updates, and contact the server to download another payload called "CONSCTLX.exe" installed on the machine. The "Reload.exe" file was originally a mechanical update. The real thing of the software in the "C: Program Files (x86) escanreload.exe" folder, in this case, overlays the "Reload.exe" file that acts as a malware payload to the old file. This file is signed with a fake digital signature. This file will block the download of the update by editing the HOSTS file.

A research team from Kaspersky, another anti-malware developer, explained more about the "Reload.exe" file. It was developed with the UnmanagedPowerShell tool, a tool that allows PowerShell scripts to be processed within any process. This file was found to run three Base64 encrypted PowerShell scripts with different functions:

The first serves to prevent further downloads of updates to avoid being updated from official company updates.

Acting to evade (Bypass) a Windows anti-malware system called Windows Antimalware Scan Interface (AMSI).

Check if the victim's machine is suitable for embedding malware in the next step. If you enter the property, it will lead to downloading the next payload.

The second malware file, named "CONSCTLX.exe," was originally a file of the real software. It is in the "C: Program Files (x86) eScanCONSCTLX.exe" folder. But the new file downloaded over it is a file with a PowerShell script hidden to set the task schedule. It overwrites the time required for the malware to run on the setup file "C: Program Files (x86) eScanEupdate.ini"

MicroWorld Technologies has warned that hacking only affects regions, does not affect users in the world, but does not reveal which countries the affected areas cover.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # it