Fake Steam keygen hides Trojan spyware 

A new Trojan spyware is making the rounds of the Internet, masquerading as a key generator for the Steam gaming platform, a computer security firm warned this week.

 

GFI Labs said clips on video-sharing site YouTube flash websites that, when visited, will lead to public portals where the supposed key generator “Generator.exe” can be downloaded.

 

“(When) running the file, users will not see any visible activities on their desktops. In the background, however, steam Game Key Generator.exe installs 7.0.1428.crx,  a Google Chrome extension file found to be a Trojan spyware, that is hosted on theonlyone(dot)goodluckwith(dot)us. This .CRX file is then installed onto Chrome upon user consent,” it said in a blog post.

 

It added the extension disguises itself as a legitimate browser plug-in, avast! WebRep, a website rating tool of security software company, AVAST Software.

 

GFI said the fake plug-in executes two JS files contained in itself: webProtection.js and background, js.

 

Using webProtection.js, it looks out for strings related to online games/gaming and email accounts, in domains the user is currently visiting.

 

It listens for “submit” or “click” events being done by users so it can log their user names, passwords, and complete URL of domains they are in.

 

The malware closely monitors the gameforge and google strings, as it is found to save the domain and log-out pages of websites containing such strings into a cookie.

 

Using background, js, it then sends this cookie to theonlyone(dot)goodluckwith(dot)us/request(dot)php?, including information on Chrome browser versions users are running.

 

To save and retrieve information to and from cookies, this spyware uses the non-existent site, hochgmaoldgcdkfolpcifkifhpibhmmh(dot)com.

 

Also, the fake plug-in is set to get updates from theonlyone(dot)goodluckwith(dot)us/update.xml.

 

On the other hand, some updates can monitor YouTube connections using the string youtu. If a connection is detected, it “auto-likes” specific videos that “appear to be clips that also showcase the fake Steam keygen.”

 

“It is important to note that the individual or group appears to have created a number of YouTube profiles just to further proliferate the bogus keygen. As of this writing, these clips have hundreds of clip views and likes. I dread to think that the higher these numbers go, the more users will likely believe that this keygen is authentic,” it said. — TJD, GMA News