There are always peculiar things malware researchers discover while analyzing new samples.

badboy1

VirusTotal 24/43

Let’s remember the filename as HD Porn TV for laterWinking smile

Our victim runs it thinking they will see the latest porno in HD quality. Instead they get a new browser ‘theme’ with a Turkish flavor:

Internet Explorer:

badboy2

Firefox:

badboy3

The bad guys hijack Winsock:

badboy4

And filter traffic through:

badboy5

From now on, all ‘sensitive’ searches such as porn are no longer displayed:

badboy6

Our victim not only gets a nasty Trojan on their PC, they also get denied of anymore porn.

Next time, don’t be so naughtyWinking smile

Posted by Jerome Segura on Malware Diaries