FreeMicrosoftToolkit Malware Site

[alvarnell]

https://freemicrosofttoolkit.com/#

Contains download links to these sites:

https://mega.nz/#!yqIGUSbI!n6gJw3cjodXIXrsUPh3x6fr3VDdRUcxo-u_VTS3KM5o
https://www.sendspace.com/file/hrpd37

Which download malware shown here https://www.virustotal.com/gui/file/9f2cae711d97e8b091ed193a5e9a931186e36fc49454230189bc16cd8cff06e7/detection

[rakka]

I can download files fine without any issue. 

[Porthos]

15 minutes ago, rakka said:

I can download files fine without any issue. 

I think he means it should be blocked.

[alvarnell]

3 hours ago, rakka said:

I can download files fine without any issue. 

And therein lies the problem. Those files are all MALWARE!

[exile360]

If you haven't done so already, please report this site in the Newest IP or URL Threats area of the forums located here: https://forums.malwarebytes.com/forum/155-newest-ip-or-url-threats/

Thanks

[rakka]

Both URLs are now blocked

[alvarnell]

13 hours ago, exile360 said:

If you haven't done so already, please report this site in the Newest IP or URL

@exile360 I'm not equipped to post to that forum as it is for the Malwarebytes for Windows application (Malwarebytes for Mac does not yet have website blocking capabilities), for the following reasons:

1. I can't verify whether or not Malwarebytes for Windows already blocks those URL's.

2. The site distributed Mac malware and I can't verify whether or not a Windows user would get a different payload.

Perhaps @rakka has taken care of that already or maybe you could check.

[gonzo]

Blocks that @rakka adds are just for the browser extension.  I have flagged @MysteryFCM here so that he can read this thread and check what is happening for the browsers themselves.

 

 

[MysteryFCM]

Cheers chaps

[alvarnell]

🙏

[exile360]

10 hours ago, alvarnell said:

@exile360 I'm not equipped to post to that forum as it is for the Malwarebytes for Windows application (Malwarebytes for Mac does not yet have website blocking capabilities), for the following reasons:

1. I can't verify whether or not Malwarebytes for Windows already blocks those URL's.

2. The site distributed Mac malware and I can't verify whether or not a Windows user would get a different payload.

Perhaps @rakka has taken care of that already or maybe you could check.

Just FYI, any site added to the block list database for Web Protection in Malwarebytes 3 for Windows will automatically be added to the blocklist databases for the Malwarebytes browser extension beta as well.  They use the same core databases to block sites.  The difference between them is simply the additional ad/tracker/clickbait block lists included with the browser extension as well as its behavior based blocking for tech support scam sites and the like, and of course Web Protection in Malwarebytes for Windows hooks into the network stack blocking sites and servers for the entire system rather than just the web browser the way the browser extension does.