However, as you will soon find out, even the safest options out there can turn into security hazards if we’re not careful. Recently, a malicious Telegram for desktop installer started distributing the Purple Fox malware to install further dangerous payloads on infected devices. This installer is a compiled AutoIt script named Telegram Desktop.exe that drops two files, an actual Telegram installer, and a malicious downloader (TextInputh.exe).

Telegram installers will install more than just the app itself

It all starts like any other banal action that we perform on our PCs, without actually knowing what goes on behind closed doors. — MalwareHunterTeam (@malwrhunterteam) December 25, 2021 According to security experts from Minerva Lab, when executed, TextInputh.exe creates a new folder named 1640618495 under: C:\Users\Public\Videos\ Actually, this TextInputh.exe file is used as a downloader for the next stage of the attack, as it contacts a C&C server and downloads two files to the newly created folder. In order to get a more in-depth view of the infection process, here’s what TextInputh.exe performs onto the compromised machine:

Copies 360.tct with 360.dll name, rundll3222.exe, and svchost.txt to the ProgramData folder Executes ojbk.exe with the “ojbk.exe -a” command line Deletes 1.rar and 7zz.exe and exits the process

The next step for the malware is to gather basic system information, check if any security tools are running on it, and finally send all that to a hardcoded C2 address. Once this process is completed, Purple Fox is downloaded from the C2 in the form of a .msi file that contains encrypted shellcode for both 32 and 64-bit systems. The infected device will be restarted for the new registry settings to take effect, most importantly, the disabled User Account Control (UAC). It’s unknown for the time being how the malware is being distributed but similar malware campaigns impersonating legitimate software were distributed via YouTube videos, forum spam, and shady software sites. If you want to get a better understanding of the entire process, we encourage you to read the full diagnostic from Minerva Labs. Do you suspect to have downloaded a malware-infected installer? Share your thoughts with us in the comments section below.

Name * Email * Commenting as . Not you? Save information for future comments
Comment

Δ