Removing user icon from qtox chat software#
Removing user icon from qtox chat code#

This measure is introduced in order to avoid detection. Sometimes the viruses can be programmed into deleting themselves if they are unable to bypass security. They are usually bypassed or removed altogether. The engine can scan for the specific signatures of anti-virus programs, sandbox or debug environments and virtual machines.

Removing user icon from qtox chat software#

Stealth Protection - The infection engine can be programmed into discovery installed security software that may interfere with the threat’s execution.

Removing user icon from qtox chat code#

Example additions to the WhiteRose code include the following: While the WhiteRose samples at the moment does not follow an advanced infection route it can be updated easily to include other options. It may also be a customized form of known malware family but with severe changes.

It is possible that the sample has been made by its operator(s) or bought from the hacker underground markets.

The iniital code analysis is not yet complete however from the obtained preliminary data the virus engine does not appear to contain any code snippets from the famous malware families. Once the WhiteRose virus has been deployed to the target computers it will immediately start to execute itself. Virus samples can be delivered using other methods such as web scripts and other malware web elements - banners, pop-ups, redirects and spam content. The WhiteRose virus itself is loaded during the initial delivery. Once they are installed the built-in infection engine redirects the users to a hacker-controlled page. In the most common case they are made compatible with the most popular software: Mozilla Firefox, Microsoft Edge, Opera, Internet Explorer, Safari and Google Chrome. They are often distributed on the relevant software repositories and contain elaborate descriptions, screenshots and fake user reviews in order to coerce the users into downloading them. If this is done then the infection is initiated.Īnother strategy relies on the use of browser hijackers, a fancy name for the various malware web browser plugins. Once they are opened by the victims a notification prompt that asks them to enable the built-in macros (scripts). They are disguised as data of user interest such as letters, invoices, notifications and etc.

Malware Documents - Computer criminals can create documents of various types (presentations, rich text documents or spreadsheets) that can infect the victims with the WhiteRose virus.

Usually the targets are creative apps, utilities and games.

Software Installers - The criminals can take the legitimate setup files of popular software and modify them with the Whiterose virus code.

In a similar way the hackers can take the malware code and integrate it in other payloads as well. Another method is the use of file attachments that are sent directly with the messages. The hyperlinks are replaced with the virus instances. This is done by taking the legitimate text and graphics of legitimate sites and portals and constructing fake versions of them. The messages are constructed in a specific way, made to coerce the target users into downloading the virus. Usually this is done by linking a copy of the virus hosted on an off-site instance. They aim to persuade the victim into interacting with the contained within malware elements.

One of the most common ways is to utilize spam email messages that are sent in bulk and contain various social engineering tricks. In these cases the hacker or criminal collective behind the threat utilize the most popular tactics. The most probable reason is to test how effective the WhiteRose virus is. At the moment the captured samples do not give an exact indication of the scale of the attacks, as such we presume that they are test attacks. The Whiterose virus can be distributed using different methods depending on the hackers targets and the ongoing campaign.