Several Malware Families Using Pay-Per-Install Service to Expand Their Targets

A detailed examination of a Pay-per-install (PPI) malware
service called PrivateLoader has revealed its crucial role in the
delivery of a variety of malware such as SmokeLoader^[1], RedLine Stealer^[2], Vidar^[3], Raccoon^[4], and GCleaner^[5]
since at least May 2021.

Loaders are malicious programs used for loading additional
executables onto the infected machine. With PPI malware services
such as PrivateLoader, malware operators pay the service owners to
get their payloads “installed” based on the targets provided.

“The accessibility and moderate costs allow malware operators to
leverage these services as another weapon for rapid, bulk and
geo-targeted malware infections,” cybersecurity firm Intel 471
said^[6]
in a new report shared with The Hacker News.

PrivateLoader, written in the C++ programming language, is
designed to retrieve URLs for the malicious payloads to be deployed
on the infected host, with the distribution primarily relying on a
network of bait websites^[7]
that have been rigged to appear prominently in search results via
search engine optimization (SEO) poisoning methods targeting users
looking for pirated software.

The administrative panel used by the PPI service offers a wealth
of functions, including adding new users, configuring a link to the
payload to be installed, modifying geolocation targeting based on
the campaign, and even encrypting the load file.

Other common payload families pushed by PrivateLoader include a
mix of remote access trojans, banking malware, and ransomware like
DanaBot^[8], Formbook^[9]
(aka XLoader), CryptBot^[10], Remcos^[11], NanoCore^[12], TrickBot^[13], Kronos^[14], Dridex^[15], NjRAT^[16], BitRAT^[17], Agent Tesla^[18], and LockBit^[19].

“PPI services have been a pillar of cybercrime for decades,” the
researchers said. “Just like the wider population, criminals are
going to flock to software that provides them a wide array of
options to easily achieve their goals.”