Crackonosh; Cracked PC games infect over 200,000* systems with cryptocurrency miner malware

[Spotty]

Summary

In a surprise to absolutely no-one, pirated games are riddled with viruses and malware.

Avast released a blog post detailing Crackonosh, a cryptocurrency miner that was hidden in the installers for a bunch of popular video games that were being illegally pirated. The cryptocurrency malware managed to mine over $2 million in cryptocurrency for the hackers responsible from over 200,000 systems that Avast detected the malware installed on. The 200,000 figure only counts systems that have Avast installed, so the actual figure would be much higher.

 

Quotes

Quote

Versions of Grand Theft Auto V, NBA 2K19, and Pro Evolution Soccer 2018 are being given away free in forums.

But hidden inside the code of these games is a piece of crypto-mining malware called Crackonosh, which secretly generates digital money once the game has been downloaded.

Criminals have made more than $2m (£1.4m) with the scam, researchers say.

^{https://www.bbc.com/news/technology-57601631}

 

What's somewhat interesting is in how the malware operated; disabling anti virus software and crippling Windows services such as windows updates and defender, as well as waiting for several system reboots before activating with the latter presumably to disguise the source of the malware with many people unaware that the pirated game they installed days or weeks ago was responsible for the malware allowing the the cracked game to be more broadly distributed before suspicions are raised.

Quote

If anecdotal reports cited by Avast were any indication, the cracked games played just fine, only with an extra bit of unseen menace.

Once a cracked game is installed, the malware makes some Windows Registry changes and installs a few executables that have names that sound like regular Windows services: winrmsrv.exe, winscomrssrv.dll and winlogui.exe. (The latter is the coin-mining part.) It lies in wait for a time, and then on the seventh or 10th restart after installation, boots the PC into Safe Mode.

 

Because antivirus software doesn't operate in Safe Mode — even Windows' own Microsoft Defender Antivirus, aka Windows Defender — booting the PC into Safe Mode gives Crackonosh an opportunity to strike.

It disables Microsoft/Defender, and deletes Avast, Bitdefender, F-Secure, Kaspersky, McAfee, Norton or Panda antivirus software if it's present. It then tweaks the Registry further to disable Windows security updates.

After all that, the malware will be ready to deploy the XMRig miner to hijack your cycles and generate Monero — and your computer will be  exposed to the full force of internet malware like a naked child in a cold winter.

^{https://www.tomsguide.com/news/cracked-games-hacked-pcs}

 

List of infected cracked games Avast found: (This is only games that have been illegally pirated. It does not affect legitimate copies of the game)

• NBA 2K19
• Grand Theft Auto V
• Far Cry 5
• The Sims 4 Seasons
• Euro Truck Simulator 2
• The Sims 4
• Jurassic World Evolution
• Fallout 4 GOTY
• Call of Cthulhu
• Pro Evolution Soccer 2018
• We Happy Few

 

My thoughts

You get what you pay for.

I usually see stuff like this as ads for anti-virus companies, such as Avast in this case, but it also serves as a good reminder not to pirate cracked games. Interestingly some of these games have already been available for free from legitimate game stores. Epic Games Store has offered both Jurassic World Evolution and GTA V for free in the past, possibly others in the list as well.

Games are entertainment, not a necessity. There's no reason to pirate games and there are plenty of good cheap or free games to play, and if there is a game you want to play just wait for it to go on sale like the Steam Summer Sale currently in progress.

 

This is just one particular virus that has been found in cracked games, but there's no doubt that other cracked games also have similar or worse infections bundled in with them.

 

There's a lot more information and details about how the malware worked in Avast's Blog post, for anyone interested in that sort of thing I would recommend giving it a read. It's a bit lengthy to include here. There are also instructions for removing Crackonosh included in the blog post if you believe you may be infected.

 

 

Sources

https://decoded.avast.io/danielbenes/crackonosh-a-new-malware-distributed-in-cracked-software/

https://www.bbc.com/news/technology-57601631

https://www.tomsguide.com/news/cracked-games-hacked-pcs

 

Edited June 28, 2021 by Spotty
made it clearer that it is only pirated games affected

[Murasaki]

2 minutes ago, Spotty said:

You get what you dont pay for.

ftfy

 

Every time I hear "Monero" its always malware related xD

[Abdullah Bhutta]

If you can't afford them, don't use them.

[Freakwise]

THIS is also true for some cracked vst (virtual instruments) for DAW 

That's been downloaded on certain website as early as 2018

There's article somewhere (I'm forgot what is it sorry, but i think the virus is called trojan.coinminers or something)

 

10 minutes ago, Spotty said:

Grand Theft Auto V

This is Unrelated but, does gta v was  free on epic games year ago or something

 

Edit: yes it was, im stupid xD

Edited June 26, 2021 by Freakwise

[Spotty]

4 minutes ago, Freakwise said:

THIS is also true for some cracked vst (virtual instruments) for DAW 

That's been downloaded on certain website as early as 2018

There's article somewhere

Yep, this is nothing new. Pirated software/games/movies/music have always been a popular delivery mechanism for malware, even going back to the "Nickelback album mp3.exe" days on P2P file sharing programs. The viruses have gotten a lot more advanced since those days, and what's interesting about this is how aggressive it was in attempting to avoid detection by delaying activation and searching for and removing anti-virus software. Goes to show that running an anti-virus won't protect you if you're pirating games.

 

4 minutes ago, Freakwise said:

This is Unrelated but, does gta v was  free on epic games year ago or something

Yep, it was free back in May last year! https://www.rockstargames.com/newswire/article/o349k55255a257/GTAV-Premium-Edition-Available-Free-on-the-Epic-Games-Store-Until-May-

I'm guessing the people who downloaded the cracked version missed it when it was free, or they were banned from GTA: Online for cheating. Seems that the lobbies in GTA Online are full of cheaters.

 

I've actually been playing Jurassic World Evolution this week which I got for free from Epic's weekly free games at the end of 2020 as part of their Christmas giveaways.

[Quackers101]

So only on cracked pirated ones?

It would be really bad if it was shared onto legit games or servers forcing you to download malware, if for example abusing the EA leaked codes for exploits?

And not like the issues that was with Gmod and other custom servers games? to online chats being able to execute files, which was very odd way of having things (old MMO thing that happened). Might have been more games since then, were people were able to execute certain commands or files.

[Spotty]

Just now, Quackers101 said:

So only on cracked pirated ones?

It would be really bad if it was shared onto legit games or servers forcing you to download malware, if for example abusing the EA leaked codes for exploits?

Only on pirated games. The malware EA embeds in to their games in the form of Lootboxes is not as easily removed, and is much more profitable for them.

[TetraSky]

*sees the list*
*starts sweating*

 

Well in any case, that number is a lot lower than I would've expected. I guess it was specific to one or two bad websites distributing repackaged infected games and not actually coming from the ru forum source of the majority of cracked games.

[Quackers101]

10 minutes ago, Spotty said:

Only on pirated games. The malware EA embeds in to their games in the form of Lootboxes is not as easily removed, and is much more profitable for them.

thats good to know

*gets a lot of worms and trojans next time* oh no.

Also sure you dont want GTA V casino, gambling with real money (or could gamble with real money).

[Master Delta Chief]

36 minutes ago, Spotty said:

My thoughts

Games are entertainment, not a necessity. There's no reason to pirate games and there are plenty of good cheap or free games to play, and if there is a game you want to play just wait for it to go on sale like the Steam Summer Sale currently in progress.

Games are indeed entertainment but in our current worldwide situation I am not surprised that a lot of people would resort to 'pirating'. You're counter argument isn't exactly great for those who 'pirate' games. Yes there's 'free' games, but remember that not everything is free. There's several reasons as to why people would do that, even before Covid. That said, in this case you should always check the source from where it comes from and make sure you check the files through an AV-scanner. 

[Freakwise]

15 minutes ago, Spotty said:

I'm guessing the people who downloaded the cracked version missed it when it was free, or they were banned from GTA: Online for cheating. Seems that the lobbies in GTA Online are full of cheaters.

Yeah i agree but, I mean it was on sale like 3 to 7 days i think

And a lot of YouTuber and gamers (atleast in here and some other) were kinda mentioning it multiple times, there's also could be a scenario where people Just Don't have pc by that point (like me believe it or not)

 

 

[Spotty]

15 minutes ago, TetraSky said:

Well in any case, that number is a lot lower than I would've expected. I guess it was specific to one or two bad websites distributing them and not actually coming from the Russian forum source of the majority of cracked games.

The 200,000+ number is only what was detected on systems of people running Avast. That won't include people running other anti-virus software or no anti virus software at all. Also keep in mind that the virus disables/removes anti virus software during installation as well.

 

4 minutes ago, Master Delta Chief said:

That said, in this case you should always check the source from where it comes from and make sure you check the files through an AV-scanner. 

It initially wasn't detected by anti-virus software and it disables anti virus software on installation to avoid detection. Running a virus scanner on cracked games isn't a guarantee they're free of viruses and even if it does get flagged as a virus most people ignore it thinking it is a false positive due to the crack/keygen/etc.

 

Just now, Freakwise said:

Yeah i agree but, I mean it was on sale like 3 to 7 days i think

And a lot of YouTuber and gamers (atleast in here and some other) were kinda mentioning it multiple times, there's also could be a scenario where people Just Don't have pc by that point (like me believe it or not)

Plus lots of people just don't trust Epic Games and would rather take their chances with a cracked game than one from Epic Games Store.

[Quackers101]

Would say some piracy is good, some piracy have saved some titles or due to awful DRM issues.

Also how its better than buying from an not so legit seller, that might make devs or others having to pay for.

[BuckGup]

That's awesome that is lays dormant until the 7-10 reboot and uses safe mode to bypass AV. Also don't forget piracy is a byproduct caused by anti-consumer practices of companies. Don't flip it 

[Sauron]

35 minutes ago, Spotty said:

Goes to show that running an anti-virus won't protect you if you're pirating games.

That's not really exclusive to pirated games, this could happen with any software you download from a non verifiable source (and sometimes even from verifiable sources).

[SteveGrabowski0]

Installs after 7-10 reboots? Man, I could be fucked in a couple of years tbh.

[SteveGrabowski0]

10 minutes ago, Caroline said:

Yeah but it's Epic 

I'll happily download their free games, but yeah fuck Epic and the Chinese government. I refuse to ever buy from that store.

[Quackers101]

3 hours ago, SteveGrabowski0 said:

I'll happily download their free games, but yeah fuck Epic and the Chinese government. I refuse to ever buy from that store.

here until tencent is 50% of the market, and also when china becomes 50% of movies due to it's growth in media production that soon or already is at the "hollywood level".

[CerealExperimentsLain]

As a youth I pirated relentlessly, free games and all.  As an adult I stopped for a few reasons:

1) I got a job and got money.
2) If you wait a couple years, every game on Steam goes on sale for $5 anyway.

3) Some games, even single player games, get a lot of updates or new content.  The Pinball Arcade was a prime example, getting new tables every few months.  I don't want to constantly have to re-pirate a game just to get an update/new content.

That said, if Steam ever shut down, you bet I'd be joining the effort to pirate the games I had paid for.

I do still 'pirate' games sometimes, but its usually for the purposes of retrocomputing and the games are not for sale today and disc copies are hard to find on eBay.  I'm not hurting anybody with those.

[Brooksie359]

4 hours ago, Spotty said:

Only on pirated games. The malware EA embeds in to their games in the form of Lootboxes is not as easily removed, and is much more profitable for them.

What would be super smart is if game companies that were so afraid of their games getting cracked released these types of versions of their games so people wouldn't want to pirate and the ones that did they could make money off of mining. Obviously all of this would be done so it couldn't be traced back to them but it might be more effective than DRM. 

[strajk-]

And that's why I only use popular repackers that have great reputation and are even connected to the big heads in the warez scene.

[Mark Kaine]

16 minutes ago, Brooksie359 said:

What would be super smart is if game companies that were so afraid of their games getting cracked released these types of versions of their games so people wouldn't want to pirate and the ones that did they could make money off of mining. Obviously all of this would be done so it couldn't be traced back to them but it might be more effective than DRM. 

im not sure what you're saying but one of the reasons"lootboxes¹" exist is because  an addict wont pirate those games, not sure u even can pirate those, but i guess theres simply no demand or if then its extremely niche…

 

¹ and of course any kind of online only game, people usually just dont pirate those, kinda defeats the purpose.So in that sense, lootboxes or "gacha" as its usually called in these circles,  is the best and smartest DRM ever.

 

 

[SteveGrabowski0]

47 minutes ago, Quackers101 said:

here until tencent is 50% of the market, and also when china becomes 50% of movies due to it's growth in media production that soon or already is at the "hollywood level".

If Tencent is ever 50% of the market as an American I'd have a lot more to worry about than which store I buy my games from tbh

[StDragon]

"Play stupid games, win stupid prizes"

 

and

 

“There is no honor among thieves"

[Quackers101]

4 minutes ago, StDragon said:

“There is no honor among thieves"

If everything was about being a thief.

Valve had some nice views around it all.