Pirated copies of Windows 10 feature hidden malicious apps designed to steal crypto

Downloading pirated software, especially an operating system, is not something you should consider - especially in light of this new report from Doctor Web. They've found multiple pirated copies of Windows 10 Pro feature a hidden trojan app called Trojan.Clipper.231 that steals cryptocurrency by substituting crypto wallet addresses in the clipboard with different addresses.

2

These unofficial and pirated builds of Windows 10 feature the malicious apps built into the OS, so it's not something you'd be able to spot when doing a clean install. Looking into the issue, Doctor Web quickly found five versions of Windows 10 on torrent tracker sites with the malicious trojan app.

The good news is that they have identified the malicious apps in the system directory.

• WindowsInstalleriscsicli.exe (Trojan.MulDrop22.7578)
• WindowsInstallerrecovery.exe (Trojan.Inject4.57873)
• WindowsInstallerkd_08_5e78.dll (Trojan.Clipper.231)

The problem comes with installation as the crypto hijackers are hidden in the EFI (Extensible Firmware Interface) partition to evade detection. Looking at the files above, the dropper (iscsicli.exe) mounts a new partition, copies the two other malicious files, deletes the original files from the main drive, and launches Trojan.Inject4.57873 and then unmounts the partition. This then injects the malicious app and code into a regular system process.

This method of injecting malware into the EFI partition is rare, so security experts are looking at this case closely. The report from Doctor Web estimates that 0.73406362 BTC and 0.07964773 ETH, which is around USD 18,976.29, have been stolen so far.

A definite reminder that pirating an OS can be dangerous and costly. Here's the list of affected pirated Windows 10 copies spotted by Doctor Web.

• Windows 10 Pro 22H2 19045.2728 + Office 2021 x64 by BoJlIIIebnik RU.iso
• Windows 10 Pro 22H2 19045.2846 + Office 2021 x64 by BoJlIIIebnik RU.iso
• Windows 10 Pro 22H2 19045.2846 x64 by BoJlIIIebnik RU.iso
• Windows 10 Pro 22H2 19045.2913 + Office 2021 x64 by BoJlIIIebnik [RU, EN].iso
• Windows 10 Pro 22H2 19045.2913 x64 by BoJlIIIebnik [RU, EN].iso