iTnews

Mandatory Chinese tax app updates to remove backdoor

By Juha Saarinen, iTnews on Jul 2, 2020 11:31AM
Mandatory Chinese tax app updates to remove backdoor

Raises concerns about what else it could download and execute.

The saga of the Chinese bank-mandated Aisino Intelligent Tax software that installed a remote access and control backdoor has taken an unexpected turn, as security researchers found it received an update that deletes the malicious code.

Trustwave Spiderlabs said the software, which foreign companies have to use to pay local taxes, downloaded a new file.

This turned out to be an uninstaller for the backdoor, which Spiderlabs named GoldenSpy.

The uninstaller executable is fetched from a host on a network allocated to China Mobile, Spiderlabs said, with a second version containing obfuscated variables to avoid antivirus appearing shortly after the first one.

Once the Aisino Intelligent Tax program runs the downloaded executable, the uninstaller deletes all GoldenSpy files and folders, as well as the entries it inserted into the Windows Registry system configuration database.

After the GoldenSpy backdoor has been removed, the uninstaller executes a Windows shell command to delete itself quietly and without notifications or user input.

While the direct threat of the GoldenSpy command and control remote access malware appears to be gone after the uninstaller has finished, Spiderlabs said it has to leave users concerned about what else could be downloaded and executed in a similar manner.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:
aisino goldenspy security spiderlabs trustwave

Partner Content

Beat the DDoS blackmails in 2021
Partner Content Beat the DDoS blackmails in 2021
Why companies fail at picking cloud modernisation partners
Partner Content Why companies fail at picking cloud modernisation partners
Shut the door on ransomware
Partner Content Shut the door on ransomware
MSI shows first laptops with Wi-Fi 6E, Nvidia RTX 30 graphics
Partner Content MSI shows first laptops with Wi-Fi 6E, Nvidia RTX 30 graphics

Sponsored Whitepapers

Five questions to ask before you upgrade to a SIEM solution
Five questions to ask before you upgrade to a SIEM solution
Effectively addressing advanced threats
Effectively addressing advanced threats
The risky business of open source
The risky business of open source
Ensure your e-signatures are legally binding
Ensure your e-signatures are legally binding
Mitigating open source risk in your organisation
Mitigating open source risk in your organisation

Events

  • On-Demand Webinar: How Poly and Microsoft are Embracing Future Work Environments
  • Beat the DDoS blackmailers in 2021
By Juha Saarinen, iTnews
Jul 2 2020
11:31AM
0 Comments

Related Articles

  • Critical SAP Sybase ASE bugs allowed full system takeover
  • ASIC joins Reserve Bank NZ as victim of Accellion hack
  • North Koreans social engineer and hack vulnerability developers
  • SonicWall discloses "coordinated attack" on internal systems
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

Australia Post is building a digital twin of its delivery network

Australia Post is building a digital twin of its delivery network

Google threatens to withdraw search engine in Australia

Google threatens to withdraw search engine in Australia

Trump pardons former Google self-driving car engineer

Trump pardons former Google self-driving car engineer

NBN Co runs fixed wireless tower on diesel generator for over two years

NBN Co runs fixed wireless tower on diesel generator for over two years

You must be a registered member of iTnews to post a comment.
Log In | Register
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.