FileCR Malware
Note: The malware is not exclusive to FileCR and we don't have proof FileCR is intentionally hosting it, but they haven't removed it. Possible sources of the malware include some uploaders on sanet, but it seems to be coming from multiple sources.
So far, malware has been found in the following cracks, but it is likely it is undiscovered in many more downloads because of how large their catalog is.
- https://filecr.com/windows/kms-matrix/
- https://filecr.com/windows/windows-activator-by-goddy/
- https://filecr.com/windows/stardock-start11
- https://filecr.com/windows/malwarebytes-premium
- https://filecr.com/windows/navicat-premium (Navicat Premium 16.2.3)
- https://filecr.com/windows/outbyte-driver-updater
- https://filecr.com/windows/jetbrains-pycharm (Premium release, you need https://greasyfork.org/en/scripts/403170-bypass-filecrypt to access)
- https://filecr.com/windows/avast-premier-antivirus
The file is an obfuscated batch snippet included as part of other scripts dropped during the cracking process. The exact details on when the malware is ran varies depending on the crack. It has basic anti-analysis in the batch itself, but the obfuscation is basic and easy to manually undo. It checks HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation
and HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current
, so to analyze it in a VM you just need to change the values there. It also creates HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Alu
, and if that value is found, it will not run. This ensures the payload runs only once per system, so delete that value to run it again.
The batch downloads another obfuscated script from a C&C server, which currently downloads a final payload from the same server, but this could change.
More analysis including partially deobfuscated script found on MAS discord at https://discord.com/channels/746721520931569757/1138942553220186172/1138942555418022010 or at https://forums.malwarebytes.com/topic/301182-script-malware-samples/
So far FileCR has not responded at all, which is unusual as they are usually very active and have removed malware in the past as quickly as 6 hours. Because the malware is included in multiple unrelated cracks and because they have not responded at all to reports, they are likely to be in some way involved in spreading or creating the malware. Also, some of the malware had descriptions written just for FileCR, which is unusual, and the description for KMS matrix contains lies about the activation given by the software.
Samples
Less obfuscated version with comments by the dev: https://pixeldrain.com/u/9G1c5UVm https://pixeldrain.com/u/RT8MX91x
Stardock crack at https://filecr.com/windows/stardock-start11: https://pixeldrain.com/u/Nz92f2zv
https://filecr.com/windows/windows-activator-by-goddy: https://pixeldrain.com/u/HaCXAuw2 malware starts at line 414, rest of the file is useless garbage.
For KMS matrix the malware is included in a modified copy of MAS, the malware starts at line 4890 of %temp%\m_srv.cmd
which is dropped when the GUI opens.
If you find any more downloads with that malware please contact us. An easy way to check is a file named cnf
included in the crack files, which contains a config used to track the source of the infections.
Am I infected?
Check the list of filecr releases known to be infected at the top, if you ran those 99% you are infected. That list is not complete, so see below too.
Check %temp% for files named cnf
, pb.bat
, pb.cmd
or NetFramework.4.0.7z
, and check %SYSTEMROOT% (C:\windows) for files named WUDFNet.exe
, WUDNet.exe
, Windows Driver Foundation (WDF).exe
, Windows Driver Foundаtion (WDF).exe
, or anything else suspicious. Also check for the key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Alu
in the registry. If that key exists, you probably have been infected.
Because the payload is downloaded when the malware is executed, you might be infected with something different that we have not discovered yet. For example, the same malware seems to have been installing Bright VPN before the final payload was swapped.