Note: The malware is not exclusive to FileCR and we don't have proof FileCR is intentionally hosting it, but they haven't removed it. Possible sources of the malware include some uploaders on sanet, but it seems to be coming from multiple sources.
So far, malware has been found in the following cracks, but it is likely it is undiscovered in many more downloads because of how large their catalog is.
- https://filecr.com/windows/navicat-premium (Navicat Premium 16.2.3)
- https://filecr.com/windows/jetbrains-pycharm (Premium release, you need https://greasyfork.org/en/scripts/403170-bypass-filecrypt to access)
The file is an obfuscated batch snippet included as part of other scripts dropped during the cracking process. The exact details on when the malware is ran varies depending on the crack. It has basic anti-analysis in the batch itself, but the obfuscation is basic and easy to manually undo. It checks
HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current, so to analyze it in a VM you just need to change the values there. It also creates
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Alu, and if that value is found, it will not run. This ensures the payload runs only once per system, so delete that value to run it again.
The batch downloads another obfuscated script from a C&C server, which currently downloads a final payload from the same server, but this could change.
More analysis including partially deobfuscated script found on MAS discord at https://discord.com/channels/746721520931569757/1138942553220186172/1138942555418022010 or at https://forums.malwarebytes.com/topic/301182-script-malware-samples/
So far FileCR has not responded at all, which is unusual as they are usually very active and have removed malware in the past as quickly as 6 hours. Because the malware is included in multiple unrelated cracks and because they have not responded at all to reports, they are likely to be in some way involved in spreading or creating the malware. Also, some of the malware had descriptions written just for FileCR, which is unusual, and the description for KMS matrix contains lies about the activation given by the software.
https://filecr.com/windows/windows-activator-by-goddy: https://pixeldrain.com/u/HaCXAuw2 malware starts at line 414, rest of the file is useless garbage.
For KMS matrix the malware is included in a modified copy of MAS, the malware starts at line 4890 of
%temp%\m_srv.cmd which is dropped when the GUI opens.
If you find any more downloads with that malware please contact us. An easy way to check is a file named
cnf included in the crack files, which contains a config used to track the source of the infections.
Check the list of filecr releases known to be infected at the top, if you ran those 99% you are infected. That list is not complete, so see below too.
Check %temp% for files named
NetFramework.4.0.7z, and check %SYSTEMROOT% (C:\windows) for files named
Windows Driver Foundation (WDF).exe,
Windows Driver Foundаtion (WDF).exe, or anything else suspicious. Also check for the key
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Alu in the registry. If that key exists, you probably have been infected.
Because the payload is downloaded when the malware is executed, you might be infected with something different that we have not discovered yet. For example, the same malware seems to have been installing Bright VPN before the final payload was swapped.