Pirated Windows 10 ISOs Include Hidden Malware

In a classic case of ‘play stupid games win stupid prizes’, it has been found that pirated copies of Windows 10 have been distributed containing malware hidden within the EFI partition.

Pirated Windows Copies Containing Malware

As reported by, hackers have distributed Windows 10 using torrents which have hidden cryptocurrency hijackers within them. The malware was hidden within the Extensible Firmware Interface partition (EFI) which is a partition that contains the bootloader and related files before the OS starts and in turn is hidden from most anti-virus programs. The malware was discovered and explained by researchers at who found that it does not execute from the EFI but instead uses the partition as a hidden place to store the infected files.

How Does it Work?

The malware consists of three stages starting with Trojan.MulDrop22.7578 which launches via the system Task Scheduler and has the goal of mounting an EFI system partition to the M:\ drive and copy two other malicious components onto it. After it does this it deletes the original trojan from the C:\ drive launches the next stage under trojan.inject4.57873 and unmounts the EFI partition. TrojanInject4.57873 then uses the Process Hollowing technique to inject Trojan.Clipper.231 into the Lsaiso.exe system process taking control. The malware then monitors the clipboard and substitutes crypto wallet addresses copied into it with attacker-provided addresses.

The researchers say that using the EFI partition as a method of malware infiltration is a very rare attack vector and is of great interest to security professionals. The researchers have also estimated that Trojan.Clipper.231 has so far managed to steal 0.73406362 BTC and 0.07964773 ETH which is around $18,976.29 a fairly hefty sum of cash.

I know Windows is expensive but at least with a reliable source, you don’t get hit with one of these.

Jakob Aylesbury

Disqus Comments Loading...

Recent Posts

Corsair Vengeance RGB EXPO 32GB Dual Channel Kit 

SetSetYesNumber of products in set2LightingLightingYesLighting ColourRGBMemoryMemory size (total)32 GBMemory TypeDDR5Number of modules2Memory Speed6000 MHzMemory voltage1.4…

11 hours ago

DeepCool AG300 CPU Cooler 

The AG300 is a compact single-tower CPU cooler representing a new generation update from the…

11 hours ago

ASUS ROG Ryujin III 240 Performance AIO CPU Liquid Cooler with OLED Display

Go cooler than cool with the ROG Ryujin III. Its roomy 3.5-inch LCD screen displays…

11 hours ago

Varmilo VEA88 Charcoal TKL Gaming Keyboard, MX-Red, White-LED

TKL mechanical keyboard with 88 keys in a UK ISO layout V-silk PBT keycaps with…

11 hours ago

Refract Gaming Indigo – 1440p/4K Pro Pre-Built Gaming PC

Pre-built gaming PC for elite tier gaming and high-quality streaming Cherry-picked hardware and hand-built by…

11 hours ago

Next Major Title Update For Dragons Dogma 2 Has Been Revealed

As I said before in this article about the best mod to get for Dragons…

11 hours ago