# Investigating IPTV Malware in the Wild
## 5 Discussion  
Although the IITMAF identified more illicit IPTV technologies as malicious than VirusTotal, VirusTotal classified a greater number of illicit IPTV app store and software URLs as malicious than the IITMAF. This is because the app store and software URLs often pointed to Android APK files or had relations with these files, which the dynamic analysis feature of the IITMAF solution is unable to execute and analyse, as it uses a Windows sandbox environment by default. Conversely, the IITMAF was still able to identify 12 of the 25 app store and software URLs as suspicious, and thus, only 8 out of 25 were classified as benign. Moreover, the IITMAF identified ransomware TTPs for three files scraped from an illicit IPTV app store included in the research sample. This demonstrates that the IITMAF is still capable of providing actionable information for a range of illegal IPTV technologies even if it has limitations when analysing APK files. Finally, the IITMAF primarily focuses on the analysis of illicit IPTV websites and the extraction of files and URLs from them. Hence, due to time constraints, the dynamic analysis of Android files that require a different sandbox environment was not implemented. Figure 9 shows some of these collected URLs for an illicit IPTV website (moviesjoy.to) that includes URLs with external domains potentially used for malvertising. The VirusTotal report for one of the external domains collected for this IPTV website, namely \"static.zdassets.com\", identified many recent malicious related files that had file names used in intrusive advertisements, which is common in illicit IPTV websites, such as \"AntiVirusExe.exe\" and \"PCCleaner\" ([[https://www.virustotal.com/gui/domain/static.zdassets.com/relations](https://www.virustotal.com/gui/domain/static.zdassets.com/relations)]([https://www.virustotal.com/gui/domain/static.zdassets.com/relations](https://www.virustotal.com/gui/domain/static.zdassets.com/relations)) (accessed on 25 August 2023)). Moreover, another URL to an external domain, bigcache.ml, had a URL path pointing to an alleged JQuery library JavaScript file. The VirusTotal report of this URL reported two malicious and one suspicious antivirus alert in addition to classifying the domain as a malware site. This implies that the iterative URL collection function is effective at collecting URLs from a website including any external domains that could be used for malvertising. Hence, the IITMAF is capable of iteratively scraping potentially malicious URLs from a website. Thus, this demonstrates that the webpage URL collection function is effective at collecting files and URLs from a webpage and submitting them for analysis. Conversely, a limitation of both the URL collection functions is that website CAPTCHA security mech  
Figure 9: IITMAF report showing collected URLs for one of the illicit webpages. anisms are often triggered when scraping a website, limiting the number of URLs and files that are collected. The likelihood of a CAPTCHA mechanism triggering is increased further where the HTTP requests made by the URL collection functions are routed through Tor. While disabling Tor for the URL collection functions could enable more URLs to be collected, this would make the IITMAF host's public IP address visible to potentially malicious websites, posing a security risk. For this aim, if the Tor function needs to be disabled, it is required to limit the functionality to URL collection. The results of this experiment suggest that the URL collection functions are sufficient even with this limitation in place. Table 2 shows the correlation from CTI sources collected for all the IPTV websites investigated in this research (Section 4). The table includes details of the following fields:  
* Signatures: potentially malicious behavioural/static signatures raised by Hybrid analysis. * Number of Files: the number of files that are extracted from a webpage. * Number of Compromised Hosts: from all the URLs that are linking out from this webpage, the number of them that are marked malicious.