Skip to main content

Updater 'Compromised'- Malwarebytes report

Thread solved

Had the following Malwarebytes 'RTP detection' event

-Log Details-
Protection Event Date: 24/03/2021
Protection Event Time: 10:46
Log File: 3786e8ba-8c8e-11eb-b180-30f9edd870a1.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1217
Update Package Version: 1.0.38623
Licence: Premium

-System Information-
OS: Windows 10 (Build 19041.867)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Program Files (x86)\Acronis\Agent\bin\updater.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Compromised
Domain: 
IP Address: 91.241.19.60
Port: 6888
Type: Inbound
File: C:\Program Files (x86)\Acronis\Agent\bin\updater.exe

Reported to Acronis with zero response - thoughts anyone?

0 Users found this helpful

-Website Data-
Category: Compromised
Domain: 
IP Address: 91.241.19.60
Port: 6888
Type: Inbound
File: C:\Program Files (x86)\Acronis\Agent\bin\updater.exe

Final results obtained from whois.ripe.net.
Results:
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '91.241.19.0 - 91.241.19.255'

% Abuse contact for '91.241.19.0 - 91.241.19.255' is 'dl@redbytes.ru'

inetnum: 91.241.19.0 - 91.241.19.255
netname: RU-REDBYTES
country: RU
org: ORG-RBL8-RIPE
admin-c: RBL9-RIPE
tech-c: RBL9-RIPE
status: ASSIGNED PI
mnt-by: IPADDRESS-RU
mnt-by: RIPE-NCC-END-MNT
mnt-routes: MNT-RU-HOSTWAY-1
mnt-domains: MNT-RU-HOSTWAY-1
created: 2019-12-13T13:06:00Z
last-modified: 2020-11-16T17:37:35Z
source: RIPE
sponsoring-org: ORG-IL432-RIPE

organisation: ORG-RBL8-RIPE
org-name: Red Bytes LLC
address: ul. Altayskaya, d. 7B, pom. 1-N, of. 9
address: 196066 Saint Petersburg
address: Russian Federation
abuse-c: RBL9-RIPE
mnt-ref: IPADDRESS-RU
mnt-by: IPADDRESS-RU
org-type: OTHER
created: 2019-12-06T13:57:16Z
last-modified: 2021-03-16T09:22:02Z
source: RIPE # Filtered

role: Red Bytes LLC
address: ul. Altayskaya, d. 7B, pom. 1-N, of. 9
address: 196066 Saint Petersburg
address: Russian Federation
abuse-mailbox: dl@redbytes.ru
phone: +7 495 0058273
nic-hdl: RBL9-RIPE
mnt-by: IPADDRESS-RU
created: 2019-12-06T13:57:17Z
last-modified: 2021-03-16T09:21:45Z
source: RIPE # Filtered

% Information related to '91.241.19.0/24AS207566'

route: 91.241.19.0/24
origin: AS207566
mnt-by: mnt-ru-hostway-1
created: 2020-07-22T13:35:48Z
last-modified: 2020-07-22T13:35:48Z
source: RIPE

% Information related to '91.241.19.0/24AS57678'

route: 91.241.19.0/24
origin: AS57678
mnt-by: MNT-RU-HOSTWAY-1
created: 2019-12-16T15:45:26Z
last-modified: 2020-07-22T12:42:48Z
source: RIPE

The above does not look like a valid Acronis website so would be a concern!

Would suggest doing a Repair Install initially to see if that still gives any further reports!

Sorry Steve probably being thick, but repair install of Acronis or Windows?  Malwarebytes report did say that website had been blocked so no need for further action, and neither Malwarebytes nor Bitdefender has flagged up any issues since.

C:\Program Files (x86)\Acronis\Agent\bin\updater.exe referenced in the report is ATI so any repair would be of Acronis, not Windows.

Thanks will do.

The repair install went through without incident, no error reports.

I'm getting these from Malwareytes too. Different IP addresses trying port 6888 to get to Acronis Updater. Seems they are trying to exploit the updater. Maybe there is a flaw in it?? 

IP addresses blocked:  185.81.68.253; 176.111.174.89; 94.102.61.39; 178.162.199.161; 94.102.61.39

These are all listed and malicious addresses on various sites. 

Does Acronis updater have an exploitable flaw??

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 2
Comments: 1727

Mark Evans wrote:

I'm getting these from Malwareytes too. Different IP addresses trying port 6888 to get to Acronis Updater. Seems they are trying to exploit the updater. Maybe there is a flaw in it?? 

IP addresses blocked:  185.81.68.253; 176.111.174.89; 94.102.61.39; 178.162.199.161; 94.102.61.39

These are all listed and malicious addresses on various sites. 

Does Acronis updater have an exploitable flaw??

Hello Mark!

Please refer to this thread where the topic in on discussion: https://forum.acronis.com/forum/acronis-cyber-protect-home-office-forum…

At the moment we are waiting news from the team.

As soon as I have them I will update the thread.

Thanks. 

Jose, the initial report of this problem was over two years ago so a response from Acronis is long overdue!

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 2
Comments: 1727

DrMopp wrote:

Jose, the initial report of this problem was over two years ago so a response from Acronis is long overdue!

Hello!

I have requested more details to the team. 

As soon as I have them I will update the threads.

Thanks in advance!