Proxyware Malware Being Distributed on YouTube Video Download Site
Summary
Proxyware malware has been distributed through YouTube video download pages and related ad pages. The campaign targets users who try to download videos for free and leads to unauthorized installation of DigitalPulse or Honeygain Proxyware.
Overview
AhnLab SEcurity intelligence Center (ASEC) reported that the same threat actor previously seen distributing proxyware through freeware ad pages continues to operate. Multiple infection cases have been found in South Korea. The latest cases include proxyware from DigitalPulse and, in some cases, Honeygain.
Proxyjacking is an attack method that installs Proxyware(software that shares system Internet bandwidth) without user consent and uses the victim system’s bandwidth for profit. It is similar to Cryptojacking, but it abuses bandwidth instead of installing a CoinMiner.
Analysis
Users searching for free YouTube video download sites may click a “Download Now” button and be redirected to an advertisement page or a malware download page. The threat actor used GitHub as a distribution platform and uploaded malicious files across multiple repositories.
The malware disguises itself as an installer named “QuickScreenRecoder” and executes a PowerShell script. After checks for loaded DLLs or virtual machines, it generates and runs a PowerShell script that installs Proxyware. During execution, NodeJS is installed, a malicious JavaScript file is downloaded, and a Windows Task Scheduler task is created under the name “DefragDiskCleanup”.
The malicious JavaScript connects to a C&C server, sends basic system information, and receives additional commands. In most cases, the downloaded command installs DigitalPulse Proxyware. Recent cases also confirmed Honeygain Proxyware. In those cases, the threat actor installed Honeygain’s “hgsdk.dll” and registered a launcher named “FastCleanPlus.exe” in Task Scheduler to execute it.
AhnLab Response Status
ASEC provided indicators of compromise( IoCs ) and file detection names for the observed malware. The report also notes that V3 products should be installed to prevent further malware infection.
Response Guidance
Users should avoid installing executable files from suspicious websites, including sites with ads or pop-ups, and should use official sources instead. Systems already infected should be protected with V3 products to reduce the risk of additional malware infection.
Conclusion
DigitalPulse and Honeygain Proxyware are being distributed through YouTube video download pages. The campaign reuses proxyware previously associated with a large Proxyjacking operation and continues to be observed in Korea, where it secretly consumes system bandwidth for financial gain.
