It sounds like a scene from an absurdist play or a companion to the old tale of dogs and cats living together in harmony, but it has now been confirmed. Servers distributing the notorious Dridex banking trojan were instead circulating clean copies of the freely available Avira antivirus program.
Avira researchers still don't know how the mixup happened, but their chief theory is that a whitehat hacker compromised some of the Dridex distribution channels and replaced the normal malicious executables with a digitally signed Avira installer. As a result, when targets opened attachments contained in spam e-mails sent by Dridex servers, the would-be marks were instead prompted to run a program designed to protect computers from the very likes of the Dridex threat.
"We still don't know exactly who is doing this with our installer and why—but we have some theories," a blog post published Friday quoted Avira malware expert Moritz Kroll saying. "This is certainly not something we are doing ourselves."
Although replacing known malware with an antivirus isn't an activity most people would consider a hacking crime, it's likely against the law in most countries. A whitehat hacker who figured out a way to penetrate Dridex servers and tamper with the malware distribution channel may have done so discreetly to prevent being detained or prosecuted by law enforcement authorities. A competing theory is that Dridex operators intentionally included the AV installer, possibly to throw off the detection process of other AV engines.
It's not the first time the Avira installer has been added to a malicious software package. Both the CryptoLocker and Teslacrypt ransomware programs have done so, although in the case of CryptoLocker, the AV installer was never executed. In the past, some malware packages have been known to disinfect an infected computer of all competing malware programs to protect the newly won asset. It may be possible that Dridex intended to use Avira in such a way and failed.
reader comments
44