Signed Fake Video Editor Installer Deploys Two Back Doors
Summary
Analysis of a signed Windows installer found two back doors: a SYSTEM-level service and a user-level program. The installer uses fake verification and failure screens; the back doors fetch instructions from servers, and one reports activity to Telegram.
Key points
- The 122 MB installer poses as a video-editor component, shows a fake robot check, requests administrator rights under a chipset-update pretext, then displays a false installation failure.
- One back door installs as the SQLServerUpdater Windows service and can run downloaded programs or commands with SYSTEM rights.
- A second back door, SQLite.exe, persists through scheduled tasks, downloads and runs programs from its server-controlled list, and sends activity logs to a Telegram bot.
- Both back doors check whether a machine is approved before acting and can receive further instructions; the analysis did not determine what real victims would receive.
- The components use separate servers and accounts, so removing or blocking one back door may leave the other operational.
- The article recommends hunting for the named service, executable paths and scheduled tasks, blocking the listed domains, and reimaging systems where the service ran with SYSTEM rights.
Article Details
- Attack Vectors
- A signed Windows installer posing as a video-editor component displayed fake verification and driver-update prompts, then used a fake installation failure to conceal installation of two back doors.
- The installer asked the user to approve a UAC prompt under the pretext of updating Chipset Device Software; approval allowed it to register a back door as a Windows service. If declined, it used scheduled tasks running as the user.
- The Electron app contacted lure and fingerprinting servers, then installed a .NET service back door and a separate Node.js-based back door.
- The back doors periodically checked their respective servers for instructions and downloaded programs to run. The service could execute commands with SYSTEM rights and could receive a ZIP that replaced its files and settings.
- The second back door attempted to persist through scheduled tasks, with a VBScript fallback, and sent an activity log to a Telegram bot.
- Defensive Notes
- Treat unexpected video-editor or driver-update installers, robot-check screens, and failed installations following an administrator prompt as suspicious.
- Hunt for the SQLServerUpdater service, C:\ProgramData\SQL Server Update and adjacent backup folders, and SQLite.exe running from a user's AppData\Local\SQLite folder.
- Look for scheduled tasks named SQLite_Startup, SQLiteUpdate, SQLServerUpdater_* and MicrosoftEdgeUpdate_<random>; the article notes that the last runs wscript.exe.
- Monitor SQLServer.UpdaterService.exe starting cmd.exe, and block the listed hydra-load domains.
- If the service ran with SYSTEM rights, the article recommends reimaging the machine rather than trusting cleanup.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hydra-app-err[.]club | Lure domain contacted by the installer to determine which fake screen to display. |
| DOMAIN | hydra-dropper[.]club | Domain the installer contacted to send victim-machine fingerprint data. |
| DOMAIN | hydra-load-admin[.]club | Server contacted by the SQLServerUpdater service for machine approval and update instructions. |
| DOMAIN | hydra-load[.]club | Back-door server contacted by SQLite.exe for approval and programs to download. |
| DOMAIN | hydra-load[.]space | Alternative back-door server SQLite.exe attempts to contact. |
| DOMAIN | hydra-load[.]work | Alternative back-door server SQLite.exe attempts to contact. |
| SHA256 | 1437ba3685c2b5ad95a3e09c47c2dee0e3adf3aa3b4a11f425a14d0631d4c9c0 | SHA-256 hash of the malicious installer analyzed in the article. |
| SHA256 | 3771634c792921fe6cfe9965c218e10a5c56146afc3faaf47ae6e744bade6cc3 | SHA-256 hash of SQLServer.UpdaterService.dll, part of the service back door. |
| SHA256 | 8607773bdec60142f6b4ff79fbb29d296e9881f70c173d4e69da0b268f799d7f | SHA-256 hash of the bundled SQLite.exe back-door copy. |
| SHA256 | b0bb7fc249224b498ed9285d53c6856afaf97113c5f758713baabab5b046ac85 | SHA-256 hash of Updater.Common.dll, listed among the analyzed back-door artifacts. |
| SHA256 | d652a7414e8f6335fa0579a3b6613ba8bce9eff694cb859736c1565e43dbdfa0 | SHA-256 hash of the installer’s app.asar component. |
MITRE ATT&CK
T1033 · System Owner/User DiscoveryThe installer and back doors collect the user name and related machine identity information.T1036 · MasqueradingThe service is named SQLServerUpdater to resemble a legitimate software updater, and the second back door uses an Edge-like scheduled-task name.T1053.005 · Scheduled TaskThe installer and SQLite.exe create scheduled tasks for persistence, including logon and recurring tasks.T1059.003 · Windows Command ShellThe service executes update-plan steps through a hidden command prompt and is observed starting cmd.exe.T1071.001 · Web ProtocolsThe installer and back doors communicate with their servers over web requests to exchange victim data and receive instructions.T1082 · System Information DiscoveryThe installer and back doors collect machine details, including Windows version, processor, and other system profile data.T1105 · Ingress Tool TransferThe back doors download programs from their servers and save them for execution.T1204.002 · Malicious FileThe installer relies on the victim running it and approving a UAC prompt presented as a chipset-software update.T1543.003 · Windows ServiceWith approval, the installer registers SQLServerUpdater as a Windows service that runs with SYSTEM rights.