cybersecurity

5299 readers

5 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Be kind
Limit promotional activities
Non-cybersecurity posts should be redirected to other communities within infosec.pub.

Enjoy!

founded 2 years ago

MODERATORS

shellsharks

tweedge

Fake ‘One Battle After Another’ torrent hides malware in subtitles (www.bleepingcomputer.com)

submitted 5 days ago by cm0002@suppo.fi to c/cybersecurity

12 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] someguy3@lemmy.world 32 points 5 days ago (1 children)

When the CD shortcut is executed, it launches Windows commands that extract and run a malicious PowerShell script embedded in the subtitle file between lines 100 and 103.

This PowerShell script will then extract numerous AES-encrypted data blocks from the subtitles file again to reconstruct five PowerShell scripts that are dropped to 'C:\Users<USER>\AppData\Local\Microsoft\Diagnostics.'

The extracted PowerShell scripts act as a malware dropper, performing the following actions on the host:

...

[–] RunJun@lemmy.dbzer0.com 13 points 5 days ago (2 children)

Very interesting. Since I left windows, this isn’t an issue for me but I will be more aware that this can happen now.

[–] FlexibleToast@lemmy.world 8 points 5 days ago (1 children)

Kind of makes me want to install Clam AV just to watch for viruses I wouldn't otherwise know about because I'm using Linux everywhere.

[–] frongt@lemmy.zip 4 points 5 days ago

I did that for a while. It didn't find any. I think because there weren't any to find.

[–] Decq@lemmy.world 4 points 4 days ago

There isn't really anything new to learn here. It's still the same old, don't run an executable to watch a movie. That the code is partly hidden in the srt/jpg is just a minor implementation detail.