Analysis of a Triple Click Fraud Threat by
Kimberly Today’s analysis will cover a malware sample submitted to Malwr on the 25th November 2013. The infected computer will act as a web proxy used by the cyber-criminals to perform click fraud.
The victim of this bundle will be confronted to 3 distinct binaries engaged in advertising fraud, reducing their network performance and resources very quickly.
The ad fraud binary incorporated in the Asprox botnet for example easily creates over 160 threads.
Now try to imagine 3 click fraud bots running at the same time, battling over the bandwidth and available resources on the infected computer. Not to mention that most of the payloads have the ability to download and install additional malware on the PC.
Upon execution Googost.exe will drop 3 binaries and run them:
hii.exe
m7001.exe
vxf.exe
http://stopmalvertising.com/rootkits/analysis-of-a-triple-click-fraud-threat.html
