The IObit Forum DeroHE Ransomware Attack

What happened

Attackers broke into the IObit forum and sent a fake license promotion to forum members. BleepingComputer dates the attack to the weekend before 19 January 2021. It says the forum ran vBulletin 5.6.1, an outdated version with a known SQL injection flaw.

The email offered a free one-year license for IObit products. A Get it Now button led to a download page. The zip file sat on IObit's own forum domain. BleepingComputer reports that the zip held digitally signed IObit files and one trojanized DLL, IObitUnlocker.dll, which was unsigned.

When the victim ran License Manager, the DLL installed the ransomware as C:\Program Files (x86)\IObit\iobit.dll. It then did the following:

• Added an autorun registry entry named IObit License Manager.
• Added Windows Defender exclusions for .dll files, rundll32.exe, and temp folders.
• Showed a fake message that said the process can take longer than expected and asked the user to keep the computer on.
• Encrypted files and added the .DeroHE extension.

The ransom notes are FILES_ENCRYPTED.html and READ_TO_DECRYPT.html. The attackers asked for 200 DERO coins, about 100 US dollars, through a Tor site. BleepingComputer says IObit did not reply to its questions. Hackread reports that the forum pages returned 404 errors and showed unwanted browser notification prompts.

Affected versions

The sources name one bad package and one bad file. They do not give a version number for the fake License Manager.

• Package: free-iobit-license-promo.zip
• Changed file: IObitUnlocker.dll, unsigned
• Main program in the zip: IObit License Manager.exe

The genuine IObit License Manager package is the clean copy to compare against. The IObit signature on the other files in the zip did not protect the user. Only the DLL was changed.

Indicators of compromise

• File: free-iobit-license-promo.zip
• Dropped file: C:\Program Files (x86)\IObit\iobit.dll
• Autorun registry entry named IObit License Manager
• Defender exclusions for .dll, rundll32.exe, and temp folders
• Encrypted files with the .DeroHE extension
• Ransom notes FILES_ENCRYPTED.html and READ_TO_DECRYPT.html
• Payment site: deropayysnkrl5xu7ic5fdprz5ixgdwy6ikxe2g3mh2erikudscrkpqd.onion

How to check

Look for the dropped DLL, the extension, and the Defender exclusions. Run these in PowerShell.

Test-Path 'C:\Program Files (x86)\IObit\iobit.dll'; Get-MpPreference | Select-Object -ExpandProperty ExclusionExtension

Then search for encrypted files and the ransom notes.

Get-ChildItem C:\ -Recurse -Include *.DeroHE,FILES_ENCRYPTED.html,READ_TO_DECRYPT.html -ErrorAction SilentlyContinue

Check the signature of any copy of IObitUnlocker.dll. The trojanized file is unsigned.

Get-AuthenticodeSignature .\IObitUnlocker.dll

What to do now

1. Disconnect an infected computer from the network.
2. Remove the autorun entry and the Defender exclusions that the malware added.
3. Restore files from a backup taken before the infection.
4. Delete free-iobit-license-promo.zip from every computer.
5. Check unsolicited license offers against the vendor's own channels before you download anything.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 73

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    IObitUnlocker.dll
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/
2. hackread.com/iobit-forum-hacked-spread-derohe-ransomware/