What is Dllhost.exe Malware?
When we were examining fake "cracked" software download websites, we stumbled upon the Dllhost.exe malicious program. It masquerades as the legitimate Windows process - dllhost.exe (COM Surrogate), in an effort to avoid being detected on Task Manager.
After it was installed on our test machine, we found that the Dllhost.exe malicious program is capable of forcibly opening websites that promote questionable content (e.g., adult-dating, pornography, gambling, etc.), online scams (e.g., fake: errors, virus warnings, outdated software alerts, lotteries, reward programs, giveaways, etc.), phishing attacks and even malware.
However, this type of malicious software can have a wide range of functions and is often updated with additional ones. Therefore, the full list of capabilities for Dllhost.exe might vary over time.
Common features of this malware include spying (e.g., keylogging and live-streaming/recording audio and video), exfiltrating data from systems and applications installed on them, encrypting data or locking the device's screen (ransomware), installing other malicious programs onto the system, replacing clipboard data and abusing system resources to generate cryptocurrency (cryptominers).
Moreover, the installation setup that infiltrated Dllhost.exe into our test system was bundled with other dubious software. As a result, users can also experience adware (advertisement displaying), browser hijacker (browser modifying and redirect causing), and various other infections.
What are infostealers and why are they a big threat to your privacy and security?
Infostealers are malicious programs that are designed to steal sensitive information from a computer or device. They can be used to collect usernames, passwords, credit card numbers, bank account details, and other confidential data. Infostealers are a big threat to your privacy and security because they can be used by cybercriminals to gain access to your accounts and commit identity theft or financial fraud. Additionally, the stolen data can be sold on the dark web or used for other malicious activities.
Why can it be difficult to spot malware that masquerades as legitimate Windows processes?
It can be difficult to spot malware that masquerades as legitimate Windows processes because the malicious program is designed to look and act like a genuine Windows process. This makes it harder for users to identify the malicious activity, as they may not be aware of the differences between a legitimate and malicious process. Additionally, some malware programs are designed to hide their presence by running in the background or using deceptive names that mimic those of legitimate processes.
