Since last week, there have been numerous reports from users that their computers have been infected with a program called “All-Radio 4.27 Portable.” After investigation, we found that this program is a symptom of a larger problem.
If you see the above program on your computer, then your system is infected with malware that installs rootkits, crypto miners, keyloggers, and a program that sends spam.
Unfortunately, while some security programs can remove some parts of the malicious Bundle, the rootkit needs to be removed manually. For this reason, if you are infected, reinstalling Windows is recommended, if possible.
Additionally, some VirusTotal results indicate that a keylogger is likely present. For this reason, if you have logged into any service while your system was infected, changing your passwords is necessary (from a different system).
The malware appears to have made its appearance last week, when users started asking for help on the forum . While All-Radio 4.27 Portable is an authentic Russian application, the malware creators copied it and added all the malicious add-ons.
When a malware security analyst began investigating the issue, he noticed that most of the users who had fallen victim had recently downloaded game cracks and Windows activation tools such as KMSpico.
The package includes malware of all kinds.
The basic installation wizard, which is able to understand whether it is in a virtual environment or not (virtual machine), installs itself in %AppData%\Microsoft\Windows\[random]\[random].exe and injects a process into explorer.exe. This process is copied to %Temp%\allradio_4.27_portable.exe and displays the application interface, which in turn calls other programs.
In detail, it installs: a spam-sending trojan, a rootkit driver, a clipboard hijacker, a crypto miner, a program for statistical purposes, and a trojan capable of downloading and installing other malware without the user's permission.
Finally, cracks have always been sources of malware. For this reason, we recommend avoiding cracks and key generators as most of them are infected.
